616 matches found
PT-2022-5813
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.10 Description The issue is related to an integer wraparound in the l2cap config req function in net/bluetooth/l2cap core.c, which can be exploited via L2CAP CONF REQ packets. This may allow an attacker to...
Malicious Package
Overview conf-dep-test is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Malicious code in pm-conf (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46eb261a723ae32c1b00f55fe3fe937ef507ef06a0929fe8ced8adcdd386219e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5378 Malicious code in pm-conf (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46eb261a723ae32c1b00f55fe3fe937ef507ef06a0929fe8ced8adcdd386219e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-23103
A stack-based buffer overflow vulnerability exists in the confsrv confctlsetapplanguage functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability...
Prototype Pollution
conf-cfg-ini is vulnerable to prototype pollution. A malicious INI file can be parsed and decoded as it does not protect the properties such as "proto" to pollute the global object prototype...
conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context...
GHSA-M6MG-JVJF-W44X conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context...
CVE-2020-28441
The CVE-2020-28441 issue affects the package conf-cfg-ini prior to 1.2.2. A malicious INI file parsed by decode can cause prototype pollution, allowing an attacker to pollute the application’s prototype and potentially enable further exploitation depending on context. Affected components: conf-cf...
CVE-2020-28441
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context...
conf-cfg-ini 安全漏洞
conf-cfg-ini is a package from the individual developer Rolf Loges in Germany. It uses Node.js to encode and decode conf/cfg/ini-Files. A security vulnerability exists in conf-cfg-ini versions prior to 1.2.2, which stems from the fact that this package is susceptible to prototype contamination; i...
CVE-2020-28441: Improperly Controlled Modification of Object Prototype Attributes
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context...
PT-2022-8895 · Unknown · Conf-Cfg-Ini
Name of the Vulnerable Software and Affected Versions: conf-cfg-ini versions prior to 1.2.2 Description: The issue arises when an attacker submits a malicious INI file to an application that parses it with decode, resulting in prototype pollution on the application. This can be exploited further...
Malicious code in test-dep-conf-my (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2960498bfa67e98a3989cbd03788d73c13cc5c55d9d7a5cca5b9b9569b926673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6475 Malicious code in test-dep-conf-my (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2960498bfa67e98a3989cbd03788d73c13cc5c55d9d7a5cca5b9b9569b926673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2021-40150
The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI...
CVE-2021-40150
The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI...
CVE-2021-40150: Files or Directories Accessible to External Parties
The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. In this way an attacker can download the entire NGINX/FastCGI configurations by querying the /conf/nginx.conf or /conf/fastcgi.conf URI...
SUSE: Security Advisory (SUSE-SU-2022:2307-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...