Ubuntu 16.04 ESM : Intel Microcode vulnerabilities (USN-5535-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5535-1 advisory. Joseph Nuzman discovered that some Intel processors did not properly initialise shared resources. A local attacker could use this to obtain sensitive...

Malicious code in 1inch.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2cc660bd230ed7799b68291cfc23fa0fe61c6267836ef9b126370995f1a7d5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin Name Directory 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Name Directory versions prior to 1.25.4 are vulnerable to cross-site request forgery, which...

Metasploit Weekly Wrap-Up

The past, present and future of Metasploit Don't miss Spencer McIntyre's talk on the Help Net Security's blog. Spencer is the Lead Security Researcher at Rapid7 and speaks about how Metasploit has evolved since its creation back in 2003. He also explains how the Framework is addressing today's...

Open-Xchange OX App Suite 跨站脚本漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange, a German company. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite versions 7.10.6 and below, which stems from the ability to bypass existing HTML file cleanup and filtering...

The vulnerability of the Cachuri module in the Microsoft Internet Information Services (IIS) network services for Windows operating systems allows a hacker to cause a service failure.

The vulnerability of the Cachuri module in the Microsoft Internet Information Services IIS network services for Windows operating systems is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of the Security Account Manager in the Windows operating system allows a perpetrator to trigger a service failure.

The vulnerability of the Security Account Manager in the Windows operating system is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a hacker to cause service failures...

WordPress plugin WooCommerce code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress plugin Import CSV Files 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Debian DSA-5184-1 : xen - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5184 advisory. - Incomplete cleanup of multi-core shared buffers for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via loca...

The vulnerability of the streaming transmission parser, related to incorrect resource cleaning or release, allows a hacker to cause a service failure.

The vulnerability of the streaming transmission parser is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: drm/plane: Move range check for formatcount earlier CVE-2021-47659 Due to the small table perturb size, a memory leak flaw was found in the Linux kernel's TCP source port generation algorithm in the net/ipv4/tcp.c...

USN-5513-1: Linux kernel (AWS) vulnerabilities

Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute arbitrary code. CVE-2021-3609 Likang Luo discovered that a race condition existed in the Bluetoo...

Malicious code in amount-normalizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d09735973491e8bc50b7327031ed78e899206756947f1e87796071689767917d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @igraal/web-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b528b8b8df766627a5ea305e8e4a7cad961d3e3c5e367b6c4c6510e37238f6d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SAP Business One 代码问题漏洞

SAP Business One is a set of enterprise management software from SAP. The software includes functions such as financial management, operations management and human resource management. A denial-of-service vulnerability exists in SAP Business One version 10.0, which stems from improper input clean...

PT-2022-3741 · Microsoft · Windows Security Account Manager +1

Name of the Vulnerable Software and Affected Versions: Windows Security Account Manager SAM affected versions not specified Description: The issue is related to the incorrect cleanup or release of resources in the Windows Security Account Manager SAM. It allows an attacker to cause a denial of...

svelte 跨站脚本漏洞

svelte is a new way to build web applications open-sourced by Svelte. A security vulnerability exists in svelte versions prior to 3.49.0, which stems from improper input cleanup in the toString function...

Malicious code in odgikqtuwcmvhpzn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 849e604c2ca9c89c0da2b89856fd4d8a4bc562b85dd2f5ad90b37c46e5aaadc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epszkyqktamihwbr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0db54ef5424a49a8959731c78f67b21979e23a77059014b733d5312aad4af2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...