com.introproventures:graphql-jpa-query-boot-starter (>=0.3.8, <=0.3.9), com.introproventures:graphql-jpa-query-example (>=0.3.8, <=0.3.9) +1 more potentially affected by CVE-2022-37734 via com.graphql-java:graphql-java (9.4)

com.graphql-java:graphql-java MAVEN version 9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.introproventures:graphql-jpa-query-boot-starter =0.3.8, =0.3.8, =0.3.8, =0.3.9 Source cves:...

Malicious code in example-yarn-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49ed18b898074c0e0df3d8de17008d5edd7e275455865ce1592b1b4bcc76ccd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2914 Malicious code in example-yarn-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49ed18b898074c0e0df3d8de17008d5edd7e275455865ce1592b1b4bcc76ccd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview wagmi-example is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-38170 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-38170 Source advisory:...

Hyundai Uses Example Keys for Encryption System

This is a dumb crypto mistake I had not previously encountered: A developer says it was possible to run their own software on the car infotainment hardware after discovering the vehicles manufacturer had secured its system using keys that were not only publicly known but had been lifted from...

Internet Bug Bounty: CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability in example dag

Apache Airflow Docker's Provider shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host. Vulnerability summary: In DAG script of airflow 2.3.3, there is a command injection vulnerability RCE in the script exampledockercopydata.py of...

CVE-2022-38362

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

CVE-2022-38362

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

CVE-2022-38362 Docker Provider <3.0 RCE vulnerability in example dag

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

CVE-2022-38362

CVE-2022-38362 affects the Apache Airflow Docker provider prior to 3.0.0. The issue stems from an example DAG shipped with the provider and is exploitable via authenticated remote code execution on the Airflow worker host, involving a BashOperator call and a template-controlled parameter (source_...

CVE-2022-38362: Undefined Security Weakness

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

zlib:example_dict_fuzzer: Use-of-uninitialized-value in fill_window

Project: https://github.com/madler/zlib.git Detailed Report: https://oss-fuzz.com/testcase?key=5167290075185152 Project: zlib Fuzzing Engine: libFuzzer Fuzz Target: exampledictfuzzer Job Type: libfuzzermsanzlib Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

Exploit for CVE-2022-30190

Five Nights at Follina's A Fullstack Academy Cybersecurity pro...

Exploit for CVE-2022-30190

Five Nights at Follina's A Fullstack Academy Cybersecurity pro...

WordPress SeatReg 1.23.0 Open Redirect

Exploit Title: WordPress Plugin ‘SeatReg’ - Unauthenticated Open Redirect Date: 01-08-2022 Exploit Author: Mariam Tariq - HunterSherlock Vendor Homepage: https://wordpress.org/plugins/seatreg/ Version: 1.23.0 Tested on: Firefox Contact me: [email protected] Description: An Open Redirection...

This Week in Spring - July 26th, 2022

Aloha, Spring fans! Im on vacation, reporting to you from the paradise-like island of Maui, Hawaii, and hoping that youre having a wonderful day! My family and I love Hawaii. Its brimming with beauty and serenity, and while the island of Maui, in the state of Hawaii, is very small, the islands ar...

com.pep1:pep1-commons-rest (0.6), io.syndesis:http-pull-push-example (>=0.4.2, <=0.4.5) +5 more potentially affected by CVE-2021-3859 via io.undertow:undertow-core (1.3.27.final)

io.undertow:undertow-core MAVEN version 1.3.27.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.pep1:pep1-commons-rest 0.6 - io.syndesis:http-pull-push-example =0.4.2, =0.4.2, =0.4.2, =0.4.5 -...

org.dromara.dynamictp:dynamic-tp-example-nacos (>=1.2.1-beta, <=1.2.2), org.noear:nacos-solon-cloud-plugin (>=2.7.3, <=3.0.0-rc2) potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.4.7)

com.alibaba.nacos:nacos-client MAVEN version 1.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - org.dromara.dynamictp:dynamic-tp-example-nacos =1.2.1-beta, =2.7.3, =3.0.0-rc2 Source cves:...

Apache Tomcat 9.0.30 < 9.0.65 Cross-Site Scripting

The version of Apache Tomcat installed on the remote host is 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22 or 10.1.0-M1 to 10.1.0-M16. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability. The Form authentication example in the examples web application displayed user...