2515 matches found
jackson-databind: denial of service via a large depth of nested objects
A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects...
TikTok Users Were Vulnerable to a Single-Click Attack
Microsoft disclosed the flaw in the Android app’s deep link verification process, which has since been fixed...
Debian: Security Advisory (DLA-3084-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
batchpatcher (=2.2.0), excel-trans (=1.22.1) potentially affected by unknown CVE via deep-translator (>=1.9.0 <=1.9.2)
deep-translator PYPI version =1.9.0, =1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on deep-translator and may be impacted: - batchpatcher =2.2.0 - excel-trans =1.22.1 Source cves: unknown CVE Source advisory: OSV:PYSEC-2022-252...
PYSEC-2022-252
The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...
Malicious code in deep-edula (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4986ffa2ccc23b4c0494dd6e754f5a4550ca5a9ca580095d0cb46f38eab36e04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2392 Malicious code in deep-edula (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4986ffa2ccc23b4c0494dd6e754f5a4550ca5a9ca580095d0cb46f38eab36e04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
golang: regexp: stack exhaustion via a deeply nested expression
A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient nesting depths. To exploit this vulnerability, an attacker would need to send large...
Examining New DawDropper Banking Dropper and DaaS on the Dark Web
In this blog post, we discuss the technical details of a new banking dropper that we have dubbed DawDropper, give a brief history of banking trojans released in early 2022 that use malicious droppers, and elaborate on cybercriminal activities related to DaaS in the deep web...
CVE-2022-23101
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...
CVE-2022-23101
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...
CVE-2022-23101
OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...
CVE-2022-23101
The CVE-2022-23101 issue affects Open-Xchange OX App Suite up to version 7.10.6, with a cross-site scripting (XSS) flaw exploitable via the appHandler in a deep link contained in an e‑mail. Root cause described across connected documents is improper handling of deep links by appHandler, enabling ...
set-deep-prop Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
GHSA-V42Q-78W8-8FCC set-deep-prop Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-23373
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
Design/Logic Flaw
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-23373 Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality...
CVE-2021-23373
The CVE-2021-23373 entry concerns set-deep-prop, where the main functionality is vulnerable to Prototype Pollution. Multiple connected sources confirm the vulnerability in set-deep-prop (e.g., GHSA, Veracode, Snyk) and describe how an attacker can pollute Object.prototype via the library’s setDee...