Malicious Package

Overview en-conduit-plugin-in-app-purchasing is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerab...

Malicious Package

Overview git-en-boite-app is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one ...

Malicious Package

Overview git-en-boite-core is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one...

Malicious code in git-en-boite-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2a28164e7297d1f76fb0f0a2321f9be542603117591c9d910bd5edb6b7add66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3368 Malicious code in git-en-boite-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4f46bbf079b977deefeb78d8bf3c63587df8e512096be79aa8e7decc4c95083 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

en-myung.co.kr Cross Site Scripting vulnerability OBB-2644748

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

new packages: mythes-en

An update is available for mythes-en. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterpri...

new packages: hunspell-en

An update is available for hunspell-en. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

CVE-2022-30777

Parallels H-Sphere 3.6.1713 allows XSS via the indexen.php from parameter...

Parallels H-Sphere 跨站脚本漏洞

Parallels H-Sphere is a web-hosting automation control panel from Parallels, Inc. It is used for shared web hosting services. Parallels H-Sphere version 3.6.2 contains a cross-site scripting vulnerability that can be exploited by attackers to perform XSS via indexen.php in the parameters...

Subrion CMS Stored Cross-site Scripting (XSS)

core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...

GHSA-6WC4-V4V5-3M82 Subrion CMS Stored Cross-site Scripting (XSS)

core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...

The vulnerability of the configuration file loader for WebUI devices of PHOENIX CONTACT RAD-ISM-900-EN-* allows a attacker to execute arbitrary code with root privileges.

The vulnerability of the configuration file loader for WebUI devices of PHOENIX CONTACT RAD-ISM-900-EN- exists due to insufficient checks on the integrity of the firmware. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

CVE-2022-29898

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware...

CVE-2022-29897

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware...

Input validation

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware...

Input validation

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware...

CVE-2022-29898

CVE-2022-29898 affects Phoenix Contact RAD-ISM-900-EN-* devices. The WebUI configuration file uploader allows an admin to trigger arbitrary code execution with root privileges due to improper validation of an integrity check value, across all firmware versions. Based on the documents, the impact ...

CVE-2022-29898 Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT

On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware...

CVE-2022-29897

CVE-2022-29897 affects Phoenix Contact RAD-ISM-900-EN-* wireless Ethernet transceivers. An improper input validation flaw in the traceroute utility exposed via the WebUI allows an admin-user to execute arbitrary code with root privileges on the OS, across all firmware versions. The documents conf...