CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...

@basket/get (>=1.1.0 <=1.2.2), @bitovi/incremental (>=1.0.0 <=1.0.2) +50 more potentially affected by CVE-2022-37257 via steal (>=0.12.9 <=2.3.0)

steal NPM version =0.12.9, =1.1.0, =1.0.0, =1.0.0, =0.0.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1-0, =0.3.0, =1.0.0, =0.4.0, =0.7.3 and more Source cves: CVE-2022-37257 Source advisory: OSV:GHSA-93Q5-3XPC-8VG3...

CVE-2022-38814

A stored cross-site scripting XSS vulnerability in the authsettings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfgloid text field...

CVE-2022-38814

A stored cross-site scripting XSS vulnerability in the authsettings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfgloid text field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the authsettings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfgloid text field...

RHEL 6 : Red Hat Single Sign-On 7.4.9 security update on RHEL 6 (Moderate) (RHSA-2021:3527)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3527 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

PT-2022-24581 · Fiberhome · Fiberhome An5506-02-B

Name of the Vulnerable Software and Affected Versions: FiberHome AN5506-02-B version vRP2521 Description: A stored cross-site scripting XSS issue in the auth settings component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg loid text field...

mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Jul 2022)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: PAM Auth Plugin. Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

MAL-2022-1175 Malicious code in auth-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware affca85a0c8e959151ae1b55f6bbc3ac15b328ded165ddd269918b33ab725cb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware affca85a0c8e959151ae1b55f6bbc3ac15b328ded165ddd269918b33ab725cb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Enable Media Replace plugin <= 3.6.3 - Auth. Path Traversal vulnerability

Auth. Path Traversal vulnerability discovered by Raad Haddad Cloudyrion GmbH in the WordPress Enable Media Replace plugin versions = 3.6.3. Solution Update the WordPress Enable Media Replace plugin to the latest available version at least 4.0.0...

Malicious Package

Overview @iamexperiences/react-auth is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

MAL-2022-3411 Malicious code in google-auth-library-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cba35f5d5ad2abbe0f380ecedf252a58857f3f01eb94ccd979f4ebcb752adef7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in google-auth-library-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cba35f5d5ad2abbe0f380ecedf252a58857f3f01eb94ccd979f4ebcb752adef7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PYSEC-2022-265

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

Remote code execution

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The pool-upgrade request...

cizohosubscriptions (>=1.0.1 <=1.0.2), code-challenge (>=0.1.0.2 <=0.1.0.8) +7 more potentially affected by CVE-2022-39227 via python-jwt (>=3.2.4 <=3.3.0)

python-jwt PYPI version =3.2.4, =1.0.1, =0.1.0.2, =6.0.0a1, =0.0.3, =1.0.1, =2.0.5, =2.0.6, =2.0.7 - zoho-subscriptions =1.0.1 Source cves: CVE-2022-39227 Source advisory: OSV:PYSEC-2022-259...

GHSA-GRVV-H2F9-7V9C gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth

Impact The power level parsing within gomatrixserverlib was failing to parse the "eventsdefault" key of the m.room.powerlevels event, defaulting the event default power level to zero in all cases. In rooms where the "eventsdefault" power level had been changed, this could result in events either...