510 matches found
Malicious code in asset-detect-filter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63f1bed965e937f905874b40b1b84c950a88fa75f246b833c791ffef97a1cf34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in asset-detect-layout (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 604f819f0f5b6ab645d72fac4c1463c58bb06d5becbe0f97465ee7001b1c5e4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1140 Malicious code in asset-detect-layout (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 604f819f0f5b6ab645d72fac4c1463c58bb06d5becbe0f97465ee7001b1c5e4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
new packages: perl-Encode-Detect
An update is available for perl-Encode-Detect. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...
GHSA-X33V-F3GP-GW2C Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo
bson/cbsonmodule.c in the mongo-python-driver aka. pymongo before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service NULL pointer dereference and crash via vectors related to decoding of an "invalid DBRef."...
Subrion CMS CSRF Vulnerability
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...
GHSA-RC94-7V55-WMG6 Subrion CMS CSRF Vulnerability
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...
GHSA-6W3H-VQ7M-V3QF Jenkins Black Duck Detect Plugin information exposure vulnerability
Jenkins Black Duck Detect Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credential...
Jenkins Black Duck Detect Plugin information exposure vulnerability
Jenkins Black Duck Detect Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credential...
CVE-2021-39754
In ContextImpl, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...
Cross-site Scripting (XSS)
Overview std/net/http/cgi is a Go standard library package std/net/http/cgi Affected versions of this package are vulnerable to Cross-site Scripting XSS. Go Vulnerability Report:When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which cou...
Cross-site Scripting (XSS)
Overview std/net/http/fcgi is a Go standard library package std/net/http/fcgi Affected versions of this package are vulnerable to Cross-site Scripting XSS. Go Vulnerability Report:When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which...
Exploit for Deserialization of Untrusted Data in H2Database H2
CVE-2021-42392-Detect About The script detects vulnerable H2...
NIST Cybersecurity Framework: A Quick Guide for SaaS Security Compliance
When I want to know the most recently published best practices in cyber security, I visit The National Institute of Standards and Technology NIST. From the latest password requirements NIST 800-63 to IoT security for manufacturers NISTIR 8259, NIST is always the starting point. NIST plays a key...
POWER METER SICAM Q100 Remote Code Execution Vulnerability
The POWER METER SICAM Q100 is a multifunctional device used to detect, report and analyze measured values and events.The POWER METER SICAM Q100 remote code execution vulnerability can be exploited by remote attackers to execute remote code...
Cacti < 1.2.18 XSS Vulnerability - Linux
Cacti is prone to a cross-site scripting XSS vulnerability via template import for the midwinter theme. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Millions of Routers, IoT Devices at Risk from BotenaGo Malware
Newly surfaced malware that is difficult to detect and written in Google’s open-source programming language has the potential to exploit millions of routers and IoT devices, researchers have found. Discovered by researchers at AT&T AlienLabs, BotenaGo can exploit more than 30 different...
Exploit for Code Injection in Gitlab
CVE-2021-22205 CVE-2021-22205 RCE 工具仅用于分享交流，切勿用于非授权测试，否则与作者无关...
Over 25% of Malicious JavaScript Is Being Obfuscated
Last year, Akamai released research on obfuscation techniques being used by cybercriminals to create malicious JavaScript. The code is unreadable, un-debuggable, and as a result, much more challenging to analyze and detect...
