CVE-2021-4281 Brave UX for-the-badge combine-prs.yml os command injection

A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It...

PT-2022-11695 · Brave · Brave Ux

Name of the Vulnerable Software and Affected Versions: Brave UX for-the-badge affected versions not specified Description: A critical issue was found in Brave UX for-the-badge, affecting some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command...

CVE-2022-39378

Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any...

Improper access control

Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any...

PT-2022-24939 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: The issue affects Discourse, a platform for community discussion. Under certain conditions, a user badge may be awarded based on a user's activity in a...

CVE-2022-39378 Displaying user badges can leak topic titles to users that have no access to the topic

Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any...

CVE-2022-39378 Displaying user badges can leak topic titles to users that have no access to the topic

Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restricted access. Before this vulnerability was disclosed, the topic title of the topic associated with the user badge may be viewed by any...

CVE-2022-39378

Discourse exposes topic titles of restricted topics to users awarded a user badge. The root cause is access control: a badge awarded based on activity in a restricted topic could allow viewing the topic title by users who should not have access. Public disclosure occurred before patching; multipl...

September 20, 2022—KB5017383 (OS Build 22000.1042) Preview

None None...

cargo-travis (>=0.0.10, <=0.0.11), cargo-travis-fork (>=0.0.11, <=0.0.12) potentially affected by unknown CVE via badge (>=0.2.0, <=0.3.0)

badge CARGO version =0.2.0, =0.0.10, =0.0.11, =0.0.12 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0057...

PT-2022-37424 · Rusttype +1 · Rusttype +1

Name of the Vulnerable Software and Affected Versions: badge versions affected versions not specified Description: The maintainer has advised that this crate is deprecated and will not receive any maintenance due to its dependency on the deprecated rusttype crate. Recommendations: At the moment,...

bear (0.1.0), proud-badge (>=0.0.1, <=0.0.5) +1 more potentially affected by CVE-2020-28438 via deferred-exec (0.3.1)

deferred-exec NPM version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on deferred-exec and may be impacted: - bear 0.1.0 - proud-badge =0.0.1, =0.0.1, =0.0.4 Source cves: CVE-2020-28438 Source advisory: OSV:GHSA-54W4-2F2P-F48H...

Malicious code in discord-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0e0581e7921896c92512dfa5537c57190e95a01b84578275fb030d31a9f4e8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2479 Malicious code in discord-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0e0581e7921896c92512dfa5537c57190e95a01b84578275fb030d31a9f4e8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-24690

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. An unauthenticated attacker...

CVE-2022-24690

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. An unauthenticated attacker...

CVE-2022-24689

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages including personal data without being authenticated. The collected information includes the badge numbers that operate as user login...

CVE-2022-24689

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages including personal data without being authenticated. The collected information includes the badge numbers that operate as user login...

Code injection

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages including personal data without being authenticated. The collected information includes the badge numbers that operate as user login...

DSK DSKNet 安全漏洞

DSK DSKNet is a data interaction program from DSK Japan. Their time and attendance data can be accessed interactively from any site connected to your network. A security vulnerability exists in DSK DSKNet versions 2.16.136.0 and 2.17.136.5, which stems from incorrectly handled access control, whi...