GHSA-H4W9-6X78-8VRJ Argo CD's external URLs for Deployments can include JavaScript

Impact All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting XSS bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions up to and including admin. The scri...

[SECURITY] Fedora 35 Update: python3-docs-3.10.5-1.fc35

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

MAL-2022-6538 Malicious code in textlint-checker-for-vuejs-jp-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c21eae78309ce5b4b1c69686fd2f5d09040ea07b938b6f0a380733599f94d2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6882 Malicious code in uxp-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2ee975f6346463b5281c76664a5ff62035a901c54c34ab02c586ce0031f4ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in uxp-documentation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in uxp-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2ee975f6346463b5281c76664a5ff62035a901c54c34ab02c586ce0031f4ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-2130

creationtimestamp| type| source ---|---|--- 2022-06-20 12:26:18+00:00| seen| https://t.me/cibsecurity/44811 2024-11-27 11:46:27+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-2130.yaml...

Malicious code in redux-data-model-documentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53b5812f64dc0e890eccf730c2030854531411dc41a95fa540bd122043cbcc01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in redux-data-model-documentation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

OPENSUSE-SU-2022:10016-1 Security update for firejail

This update for firejail fixes the following issues: firejail was updated to version 0.9.70: - CVE-2022-31214 - root escalation in --join logic boo1199148 Reported by Matthias Gerstner, working exploit code was provided to our development team. In the same time frame, the problem was independentl...

Metasploit Weekly Wrap-Up

vCenter Secret Extracter Expanding on the work of the vcenterforgesamltoken auxiliary module, community contributor npm-cesium137-io has added a new module for extracting the vmdir/vmafd certificates, the IdP keypair, the VMCA root cert, and anything from vmafd that has a private key associated,...

GHSA-3JCH-9QGP-4844 Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit...

Generated code can read and write out of bounds in safe code

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit...

CVE-2022-32155

CVE-2022-32155 concerns Splunk Universal Forwarder management services. The issue described in the sources is that versions before 9.0 expose management services remotely by default, creating a potential exposure rather than a technical vulnerability. Splunk 9.0 binds the management port to local...

Apache Tomcat EncryptInterceptor DoS

The vulnerability of the EncryptInterceptor class implementation in Apache Tomcat applications is related to incomplete documentation regarding program execution. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.308.9 - x86/speculation/mmio: Fix late microcode loading Patrick Colp Orabug: 34276099 5.4.17-2136.308.8 - Add debugfs for controlling MMIO state data Kanth Ghatraju Orabug: 34202259 CVE-2022-21123 CVE-2022-21125 CVE-2022-21127 CVE-2022-21166 - KVM: x86/speculation: Disable Fill buffe...

CVE-2022-31045

creationtimestamp| type| source ---|---|--- 2022-06-10 00:33:44+00:00| seen| https://t.me/cibsecurity/44153 2025-07-25 01:12:22+00:00| seen| https://gist.github.com/ferasdour/504aa49686f8e64564249de44cd5eab2...

CVE-2022-1970

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: The originally reported issue in https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0 is a known misconfiguration, and recommendation already exists in the Keycloak documentation to...

GHSA-R7V4-JWX9-WX43 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator

Background CILogon is a federated auth provider that allows users to authenticate themselves via a number of Identity Providers IdP, focused primarily on educational and research institutions such as Universities. More traditional and open IdPs such as GitHub, ORCID, Google, Microsoft, etc are al...

CVE-2021-42887

creationtimestamp| type| source ---|---|--- 2022-06-03 16:26:30+00:00| seen| https://t.me/cibsecurity/43814 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-42887.yaml...