Ingredients Stock Management System Arbitrary File Deletion Vulnerability

Ingredients Stock Management System is an ingredient stock management system from Carlo Montero's personal developer. v1.0 of Ingredients Stock Management System is vulnerable to an arbitrary file deletion vulnerability in component /classes/ Master.php?f=deleteimg lacks validation for the delete...

Google Chrome Microsoft Edge Information Disclosure

The vulnerability of the File components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information through a specially created web page...

Hitachi Energy MSM Product

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: MSM Product Vulnerability: Reliance on Uncontrolled Component 2. RISK EVALUATION Successful exploitation of this vulnerability could disrupt the functionality of the MSM web...

Levels of Assurance for DoD Microelectronics

The NSA has has published criteria for evaluating levels of assurance required for DoD microelectronics. The introductory report in a DoD microelectronics series outlines the process for determining levels of hardware assurance for systems and custom microelectronic components, which include...

A CISO's Ultimate Security Validation Checklist

If you're heading out of the office on a well-deserved vacation, are you certain the security controls you have in place will let you rest easy while you're away? More importantly – do you have the right action plan in place for a seamless return? Whether you're on the way out of – or back to – t...

PEAR Archive_Tar Improper Link Resolution Vulnerability

PEAR ArchiveTar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party...

Connected Components Workbench Path Traversal Privilege Escalation

The vulnerability of the software for designing and configuring Connected Components Workbench controllers is related to incorrect path name restrictions in the restricted access catalog during file syntax analysis. Exploiting this vulnerability can allow attackers to increase their privileges...

Security Bulletin: IBM QRadar SIEM includes components with multiple known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed the relevant vulnerabilities. Vulnerability Details CVEID:CVE-2021-43859 DESCRIPTION: XStream is vulnerable to a denial of service, caused by...

Malicious Package

Overview ing-feat-cms-components is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview lusha-ui-components-v2 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Chrome’s zero-day flaw allows arbitrary code execution

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary A vulnerabilityCVE-2022-2856 in Google Chrome, has been exploited in the wild. Additionally, Chrome has addressed several other use-after-free vulnerabilities in multiple components, including FedCM,...

Malicious code in lusha-ui-components-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa9f9d0ba99666d4d11e0f3fbfc797f53cdc33def310cfb00479955631833669 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-335 Malicious code in @hmg-sucasa-npm/my-account-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e6d1624c29c45316991574eebe325dd43d686093cc993384a32baa74eb46961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Softing Secure Integration Server code-related vulnerabilities

Softing Secure Integration Server is a secure integration server from Softing Germany. It provides a powerful OPC UA data integration layer and supports interface abstraction, aggregation, data preprocessing and security supervision. Softing Secure Integration Server version 1.22, edgeConnector...

designing and configuring controllers Data Compromise

The vulnerability of the DLL library used in software for designing and configuring Connected Components Workbench controllers, the Safety Instrumented Systems Workstation, and the application development environment for programmable logic controllers ISaGRAF Workbench is related to incorrect...

Adobe Experience Manager Core Components跨站脚本漏洞

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications, and forms. A cross-site scripting vulnerability exists in Adobe Experience Manager Core Components 2.20.6 and prior versions, which originates when a victim accesses a...

GHSA-QCGC-6Q86-7X2P AEM WCM Core Components CVG Image vulnerable to Reflected Cross-site Scripting

Core Components version 2.20.6 and earlier suffer from a reflected cross-site scripting XSS vulnerability in AdaptiveImageServlet via SVG images. An attacker with author access can upload a special crafted SVG image including a malicious Javascript and obtain a link that, when loaded by another...

AEM WCM Core Components CVG Image vulnerable to Reflected Cross-site Scripting

Core Components version 2.20.6 and earlier suffer from a reflected cross-site scripting XSS vulnerability in AdaptiveImageServlet via SVG images. An attacker with author access can upload a special crafted SVG image including a malicious Javascript and obtain a link that, when loaded by another...

Malicious Package

Overview @bigid-ui/components is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Microsoft tackles DogWalk zero-day vulnerability and multiple privilege escalation vulnerabilities

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Microsoft Patch Tuesday addresses CVE-2022-34713, also known as DogWalk, as well as numerous issues affecting Microsoft Exchange Server, Microsoft Windows Support Diagnostic Tool MSDT, Windows Print...