824 matches found
Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection
The plugin unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import intentionally or not a malicious file and a suitable gadget chain is present on the blog. To simulate a gadget chain, put the following code in a plugin class Evil public...
CVE-2022-42004
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...
Google Chrome 安全漏洞
Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in Google Chrome prior to version 106 that stems from insufficient policy enforcement in the Customization tab...
A first look at the builder for LockBit 3.0 Black
A few months after the LockBit gang released version 3.0 of its ransomware, LockBit 3.0 Black, the builder for it has been leaked by what seems to be a disgruntled developer. LockBit has been by far the most widely used ransomware in 2022 and the appearance of the builder could make things worse...
SUSE-SU-2022:2856-1 Security update for java-1_8_0-openjdk
This update for java-180-openjdk fixes the following issues: - Updated to version jdk8u345 icedtea-3.24.0 - CVE-2022-21540: Fixed a potential Java sandbox bypass bsc1201694. - CVE-2022-21541: Fixed a potential Java sandbox bypass bsc1201692. - CVE-2022-34169: Fixed an issue where arbitrary byteco...
[SECURITY] Fedora 36 Update: powerline-go-1.22.1-3.fc36
A Powerline like prompt for Bash, ZSH and Fish. - Shows some important details about the git/hg branch - Changes color if the last command exited with a failure code - If you're too deep into a directory tree, shortens the displayed path with an ellipsis - Shows the current Python virtualenv...
Simplify SIEM Optimization With InsightIDR
Two key ways InsightIDR helps customers tailor reporting, detection, and response — without any headaches For far too many years, security teams have accepted that with a SIEM comes compromise. You could have highly tailored and custom rule sets, but it meant endless amounts of tuning and...
Important: Red Hat Security Advisory: RHUI 4.1.1 release - Security Fixes and Enhancement Update
An updated version of Red Hat Update Infrastructure RHUI is now available. RHUI 4.1.1 introduces important enhancements and fixes several security bugs. Red Hat Update Infrastructure RHUI offers a highly scalable, highly redundant framework that enables you to manage repositories and content. It...
[SECURITY] Fedora 35 Update: golang-github-mailru-easyjson-0.7.6-5.fc35
Package Easyjson provides a fast and easy way to marshal/unmarshal Go structs to/from JSON without the use of reflection. In performance tests, easyjson outperforms the standard encoding/json package by a factor of 4-5x, and other JSON encoding packages by a factor of 2-3x. Easyjson aims to keep...
PT-2022-19896 · Unknown · Octopus Server
Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows customization of the help sidebar in Octopus Server to include a Cross-Site Scripting payload in the support link. Recommendations: At the moment, there is no...
[SECURITY] Fedora 36 Update: golang-github-mailru-easyjson-0.7.6-5.fc36
Package Easyjson provides a fast and easy way to marshal/unmarshal Go structs to/from JSON without the use of reflection. In performance tests, easyjson outperforms the standard encoding/json package by a factor of 4-5x, and other JSON encoding packages by a factor of 2-3x. Easyjson aims to keep...
Inconsistent balance when fee-on transfer tokens.
Lines of code Vulnerability details Impact There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer or transferFrom. Proof of...
Brave Now Lets You Customize Search Results—for Better or Worse
The privacy-focused company's new Goggles tool allows users to weed out the noise—whatever that might mean...
cjs-forms (>=0.0.1, <=1.0.0), output-customization (1.0.0) potentially affected by unknown CVE via @ve-private/test-helpers (0.0.1-security.9)
@ve-private/test-helpers NPM version 0.0.1-security.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ve-private/test-helpers and may be impacted: - cjs-forms =0.0.1, =1.0.0 - output-customization 1.0.0 Source cves: unknown CVE Source advisory:...
Malicious code in azure-output-customization-samples-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d5ff919587c11d92bc45cd5aac11848d661f31e8faf9472c84d1b15213cc8df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1360 Malicious code in azure-output-customization-samples-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d5ff919587c11d92bc45cd5aac11848d661f31e8faf9472c84d1b15213cc8df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Spring Data MongoDB SpEL Expression Injection Vulnerability (CVE-2022-22980)
Updates 06-20 CVE-2022-22980 is published 06-20 Spring Data MongoDB 3.4.1 and 3.3.5 are available Table of Contents Overview Vulnerability Am I Impacted Status Suggested Workarounds Overview We would like to announce that we have released Spring Data MongoDB 3.4.1 and 3.3.5 to address the followi...
Admin-Panel_Finder - A Burp Suite Extension That Enumerates Infrastructure And Application Admin Interfaces (OTG-CONFIG-005)
A burp suite extension that enumerates infrastructure and application Admin Interfaces. OWASP References: Classification : Web Application Security Testing 02-Configuration and Deployment Management Testing OTG v4 : OWASP OTG-CONFIG-005 WSTG : WSTG-CONF-05 Why should I use this extension?...
CVE-2022-24870: Improper Neutralization of Input During Web Page Generation
Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in tooltips using iTop customization mechanism. This provides a stored cross site scripting attack vector to authorized users of the system. Users are advised to...