PT-2022-19693 · Qualys · Qualys Cloud Agent

Name of the Vulnerable Software and Affected Versions: Qualys Cloud Agent version 4.8.0-49 Description: An issue was discovered in Qualys Cloud Agent where it writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may unexpectedly write credentials from environmen...

Malicious creator can create different NFT drop collections with NFTs that will be revealed to correspond to same ipfs token URI

Lines of code Vulnerability details Impact The following createNFTDropCollection function with different name, symbol, and nonce can be called to create different NFT drop collections. function createNFTDropCollection string calldata name, string calldata symbol, string calldata baseURI, bytes32...

Important: Red Hat Security Advisory: Service Telemetry Framework 1.4 security update

An update is now available for Service Telemetry Framework 1.4 for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

IDOR allows to create new collection or modify a existing one

Description A normal user can create a new collection with the provided book ids or add new books to an existing collection, whose operations should be only executed by the administrator. \ \ This is possible due to an missing administrative role check in the /api/collection/update-for-series API...

collection-appareils.fr Cross Site Scripting vulnerability OBB-2828170

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

All the Data Amazon's Ring Cameras Collect About You

The popular security devices are tracking and sharing more than you might think...

[SECURITY] Fedora 35 Update: lua-5.4.4-3.fc35

Lua is a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Lua is free software. Lua combines simple procedural syntax with powerful data description constructs based on associative arrays and...

Cross-site Scripting (XSS)

github.com/velocidex/velociraptor is vulnerable to cross-site scripting. The vulnerability exists in multiple functions in artifacts/syntax.js because the variables are not properly escaped in artifact collection report which allows an attacker to inject and execute malicious javascript...

CVE-2022-35630

A cross-site scripting XSS issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2...

CVE-2022-35630 Unsafe HTML Injection in Artifact Collection Report

A cross-site scripting XSS issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2...

PT-2022-22933 · Unknown · Velociraptor

Name of the Vulnerable Software and Affected Versions: Velociraptor versions prior to 0.6.5-2 Description: A cross-site scripting XSS issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. Recommendations: For versions...

Veritas NetBackup 安全漏洞

Veritas NetBackup is a storage service from Veritas, Inc. that is used to provide backup and recovery capabilities for enterprise environments. The software supports the detection of ransomware and the protection of metadata, virtual environments, and other environmental data backups. A security...

CVE-2022-35630

A cross-site scripting XSS issue in generating a collection report made it possible for malicious clients to inject JavaScript code into the static HTML file. This issue was resolved in Velociraptor 0.6.5-2...

CVE-2022-34501

The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party...

CVE-2022-34501

The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party...

CVE-2022-34501

CVE-2022-34501 concerns the bin-collection package for Python (PyPI) prior to v0.1, where a third-party backdoor enables code execution. The vulnerability affects the library’s handling of external packages mirrored from various sources, allowing an attacker to inject and execute malicious code. ...

CVE-2022-34501

The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party...

bin_collection 安全漏洞

bincollection is used to check an iCal file for a specified date. A security vulnerability exists in bincollection that originates from a code execution backdoor inserted by a third party...

bin_collection 安全漏洞

bincollection is used to check if an iCal file has a specified date. A security vulnerability exists in bincollection that stems from the presence of a code execution backdoor that allows third-party injection...

CVE-2022-31146

Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at runtime then the GC pass will...