Malicious code in core-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bdfd71008501f118552100797abf6fb298f1db14a272dda22ede246874ef20c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2190 Malicious code in core-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bdfd71008501f118552100797abf6fb298f1db14a272dda22ede246874ef20c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6954 Malicious code in voicemail-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49069432ab7ae202e87a0c30a1b09b23452139760e09eb5abf07f85392d2fbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authentication Bypass

parse-server is vulnerable to authentication bypass. The vulnerability exists because the certificate in auth adapter is not properly validated. An attacker is able to bypass authentication checks by making a fake certificate accessible via certain Apple domains and providing the URL to that...

anomalydetection (=0.0.0.dev1), csh-ldap (>=2.2.1.dev6 <=2.3.1.dev4) +12 more potentially affected by CVE-2021-46823 via python-ldap (>=2.4.19 <=3.3.1)

python-ldap PYPI version =2.4.19, =2.2.1.dev6, =0.0.2, =0.4.4, =1.0.0, =0.0.0, =1.0.0, =1.1.7, =0.4.4, =0.0.1, =1.3.3, =0.8.0, =0.9.2 Source cves: CVE-2021-46823 Source advisory: OSV:GHSA-QFR5-WJPW-Q4C4...

CVE-2022-20176

In authstore of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid...

Out-of-bounds

In authstore of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid...

PT-2022-14405 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel versions affected versions not specified Description: In the auth store of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosure with...

DOMDig - DOM XSS Scanner For Single Page Applications

DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can simulate a...

CVE-2021-44266

GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...

CVE-2021-44266

GUnet Open eClass aka openeclass before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

ConfluentPwn Confluence pre-auth ONGL injection remote code ex...

CLSA-2022-1654525948 Fixed CVEs in python2-pip-18.module_el8.4.0+2051+0b56c8de: CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-4189

CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler rhbz2047376 - CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response rhbz2047376 - CVE-2021-4189: ftplib should not use the host from the PASV response rhbz2047376 - CVE-2022-0391: urllib.parse...

GHSA-342C-VCFF-2FF2 Login timing attack in ezsystems/ezplatform-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

CVE-2022-30352

phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "authuser" parameter in index.php script...

CVE-2021-27780

CVE-2021-27780 affects HCL Technologies BigFix Mobile/Modern Client Management (versions v1.x, v2.0). The root cause is improper handling of XML interfaces in unauthenticated contexts, enabling Un-Auth XML interaction and unauthenticated device enrollment. Impact described in sources includes una...

Exploit for Path Traversal in Wso2 Api_Manager

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-2...

CVE-2022-24414

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

Design/Logic Flaw

Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attac...

CVE-2022-24414

CVE-2022-24414 affects Dell EMC CloudLink 7.1.3 and earlier. The authentication token is exposed in GET request parameters, which can be logged by reverse proxies and servers, potentially allowing attackers to access the CloudLink server. The underlying issue is insecure token usage in URLs. Expe...