CVE-2022-39008

The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and write files that are accessible only to system apps...

Self-spreading stealer attacks gamers via YouTube

UPD: A notice on Googles response to the issue was added. An unusual malicious bundle a collection of malicious programs distributed in the form of a single installation file, self-extracting archive or other file with installer-type functionality recently caught our eye. Its main payload is the...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

Design/Logic Flaw

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

cosign 数据伪造问题漏洞

cosign is a container signing, verification and storage in an OCI registry in the United States. A data forgery issue vulnerability exists in cosign versions prior to 1.12.0 that stems from Bundle mismatches leading to invalid validation, not checking certificate identity in some cases, invalid...

SUSE-SU-2022:3177-1 Security update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja = and = 23.0.0 bsc1201082 - Add support for name, pkgs and diffattr parameters to upgrade function for zypper and yum bsc1198489 - Fix possible errors on...

SUSE-SU-2022:3172-1 Security update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Add support for gpgautoimport in zypperpkg module - Update Salt to work with Jinja = and = 23.0.0 bsc1201082 - Add support for name, pkgs and diffattr parameters to upgrade function for zypper and yum bsc1198489 - Fix possible errors on...

MAL-2022-7054 Malicious code in wcebpack-bunde-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c7a4300818daab208570421a84bcdd8e7b4950dcae1e6a5dd08f17d9e135497 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Design/Logic Flaw

An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed...

MAL-2022-688 Malicious code in @ucs-private/rollup-plugin-dts-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ae7ccf37aa51057551072c84cb55e3bc7c73e6139db593a7c3c45970480257a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

USN-5473-2 ca-certificates update

USN-5473-1 updated ca-certificates. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.50 version of the Mozilla...

MAL-2022-6377 Malicious code in swiper-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b97df99e38008c85b965c6dbc9277f1c08a98288578d244c25a5eb8d2d853d5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in swiper-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b97df99e38008c85b965c6dbc9277f1c08a98288578d244c25a5eb8d2d853d5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

biz.netcentric.cq.tools.accesscontroltool:accesscontroltool-bundle (>=3.6.0 <=4.2.1), biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4 <=3.6.2) +440 more potentially affected by CVE-2022-32549 via org.apache.sling:org.apache.sling.api (>=2.0.2-incubator <=2.25.0)

org.apache.sling:org.apache.sling.api MAVEN version =2.0.2-incubator, =3.6.0, =2.5.4, =3.0.0, =4.2.0, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =2012.12.01, =2012.12.01, =0.0.4, =4.0.4 - com.adobe.aem:aem-sdk-api =2020.6.3800.20200626T210738Z-200604 - com.adobe.commerce.cif:core-cif-components-it-http =1.2...

CVE-2022-2068

creationtimestamp| type| source ---|---|--- 2022-06-21 16:50:50+00:00| seen| https://t.me/antichat/9887 2025-01-26 09:43:06+00:00| published-proof-of-concept| Telegram/6MjhSnJNjnU7ZuaxfNMF1kI6EhfOaDQaVfpRiMhlDYDzF4 2025-02-14 16:37:45+00:00| seen|...

MAL-2022-4350 Malicious code in loblaws-mkt-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea14e6341d6cce727bc70b18f296d4597f68f72df8956aad5e7fe6adb92ff6f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in loblaws-mkt-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea14e6341d6cce727bc70b18f296d4597f68f72df8956aad5e7fe6adb92ff6f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...