2787 matches found
PYSEC-2022-252
The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...
Malicious code in deep-edula (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4986ffa2ccc23b4c0494dd6e754f5a4550ca5a9ca580095d0cb46f38eab36e04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2392 Malicious code in deep-edula (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4986ffa2ccc23b4c0494dd6e754f5a4550ca5a9ca580095d0cb46f38eab36e04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
golang: regexp: stack exhaustion via a deeply nested expression
A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large...
PT-2022-32431
Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.18 through v5.18.12 Description A potential security issue has been identified in the Linux Kernel, related to the atlantic net function. The issue concerns the deep parameter on suspend/resume functions. The actual...
Examining New DawDropper Banking Dropper and DaaS on the Dark Web
In this blog post, we discuss the technical details of a new banking dropper that we have dubbed DawDropper, give a brief history of banking trojans released in early 2022 that use malicious droppers, and elaborate on cybercriminal activities related to DaaS in the deep web...
CVE-2022-23101
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...
CVE-2022-23101
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...
CVE-2022-23101
The CVE-2022-23101 issue affects Open-Xchange OX App Suite up to version 7.10.6, with a cross-site scripting (XSS) flaw exploitable via the appHandler in a deep link contained in an e‑mail. Root cause described across connected documents is improper handling of deep links by appHandler, enabling ...
CVE-2022-23101
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...
CVE-2022-23101
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...
CVE-2022-23101: Improper Neutralization of Input During Web Page Generation
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...
set-deep-prop Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
GHSA-V42Q-78W8-8FCC set-deep-prop Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-23373
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
Design/Logic Flaw
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-23373
The CVE-2021-23373 entry concerns set-deep-prop, where the main functionality is vulnerable to Prototype Pollution. Multiple connected sources confirm the vulnerability in set-deep-prop (e.g., GHSA, Veracode, Snyk) and describe how an attacker can pollute Object.prototype via the library’s setDee...
CVE-2021-23373
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...