4441 matches found
MAL-2022-7091 Malicious code in webcm-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 955551845e6b60e5f365bfcce33f45968362811ecfea804b34c2e2ecefcb651f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in webcm-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 955551845e6b60e5f365bfcce33f45968362811ecfea804b34c2e2ecefcb651f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
USN-5587-1: curl vulnerability | Cloud Foundry
Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Axel Chong discovered that when curl accepted and sent back cookies containing control bytes that a HTTPS server might return a 400 Bad Request Error response. A malicious cookie host...
ZFile arbitrary file upload vulnerability
ZFile is a Java-based online web development program open-sourced by zfile-dev. ZFile v4.1.1 contains an arbitrary file upload vulnerability that stems from a lack of validation of uploaded files in its component /file/upload/1. An attacker could exploit this vulnerability to upload malicious fil...
Teleport 10.1.1 Remote Code Execution
Exploit Title: Teleport v10.1.1 - Remote Code Execution RCE Date: 08/01/2022 Exploit Author: Brandon Roach & Brian Landrum Vendor Homepage: https://goteleport.com Software Link: https://github.com/gravitational/teleport Version: /dev/tcp/10.0.0.1/5555 0&1...
Microsoft Warns of Large-Scale Click Fraud Campaign Targeting Gamers
Microsoft said it's tracking an ongoing large-scale click fraud campaign targeting gamers by means of stealthily deployed browser extensions on compromised systems. "The attackers monetize clicks generated by a browser node-webkit or malicious browser extension secretly installed on devices,"...
PT-2022-34116 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: The issue is related to sleep in atomic context bugs caused by dev coredump. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...
GSD-2022-1005466 xfrm: policy: fix metadata dst->dev xmit null pointer dereference
xfrm: policy: fix metadata dst-dev xmit null pointer dereference This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.64 by commit...
GSD-2022-1005056 xfrm: policy: fix metadata dst->dev xmit null pointer dereference
xfrm: policy: fix metadata dst-dev xmit null pointer dereference This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.6 by commit...
ledger-rest-api-dev (>=0.1.9 <=0.1.10) potentially affected by CVE-2022-31006 via indy-node (=1.0.28)
indy-node PYPI version =1.0.28 is affected by a known vulnerability. The following packages have a transitive dependency on indy-node and may be impacted: - ledger-rest-api-dev =0.1.9, =0.1.10 Source cves: CVE-2022-31006 Source advisory: OSV:GHSA-X996-7QH9-7FF7...
PT-2022-33484 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to a refcount leak in the mt8173 rt5650 rt5676 dev probe function. It was introduced in version v4.2 and fixed in version v5.19.2. The actual impact and attack...
PT-2022-33419 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: A NULL pointer dereference issue exists in the dev parse header protocol function when skb-dev is null. This issue was introduced in version v5.12 and is fixed in Linux Kernel version v5.19....
PT-2022-33710 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.64 Description: The issue concerns data-races around weight p and dev weight rtx bias. It was introduced in version v4.11 and fixed in version v5.15.64. The actual impact and attack plausibility have not y...
CVE-2022-3222
Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV...
U.S. Charges 3 Iranian Hackers and Sanctions Several Others Over Ransomware Attacks
The U.S. Treasury Department's Office of Foreign Assets Control OFAC on Wednesday announced sweeping sanctions against ten individuals and two entities backed by Iran's Islamic Revolutionary Guard Corps IRGC for their involvement in ransomware attacks at least since October 2020. The agency said...
GPAC 安全漏洞
GPAC is an open source multimedia framework. A security vulnerability exists in versions prior to GPAC 2.1.0-DEV that stems from a segmentation error in SFSExpression...
Cloudflare Public Bug Bounty: Take over subdomains of r2.dev using R2 custom domains
███████ ████ ████ ███████████████████████████ ███ ██████████ It is possible to take over any subdomain of r2.dev possible also the base domain and have it serve the contents of an R2 bucket in your account. Requirements Access to R2 public buckets in the dashboard is currently behind a flag. The...
PT-2022-4899 · Unknown · Enlightenment
Name of the Vulnerable Software and Affected Versions: Enlightenment versions prior to 0.25.4 Description: The issue is related to the Enlightenment window manager's system file, specifically with the enlightenment sys component. It is setuid root and mishandles pathnames that begin with a /dev/...
Malicious Package
Overview wrangler-dev-api-app is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
CVE-2022-3178
Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV...