Security Bulletin: IBM Security SiteProtector System is affected by multiple vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in a Core XPU. Vulnerability Details CVEID:CVE-2020-4150 DESCRIPTION: IBM SiteProtector Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound...

DEBIAN-CVE-2022-33743

network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP eXpress Data Path, a code label was moved in a way allowing for SKBs having references pointers retained for further processing to nevertheless be freed...

ALPINE-CVE-2022-33743

network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP eXpress Data Path, a code label was moved in a way allowing for SKBs having references pointers retained for further processing to nevertheless be freed...

UBUNTU-CVE-2022-33743

network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP eXpress Data Path, a code label was moved in a way allowing for SKBs having references pointers retained for further processing to nevertheless be freed...

Xen 安全漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in Xen that...

OESA-2022-1733 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A DMA reentrancy issue was found in the NVM Express Controller NVME emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset...

TypeORM SQL Injection Vulnerability

typeorm CVE-2022-33171 findOneid, findOneOrFailid The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to S...

passport 授权问题漏洞

passport is an Express-compatible Node.js authentication middleware from Jared Hanson, an individual developer in the United States. A security vulnerability exists in passport, which stems from the fact that when a user logs in or logs out, the session is regenerated instead of being closed...

Remote Code Execution (RCE)

Overview eta is a Lightweight, fast, and powerful embedded JS template engine Affected versions of this package are vulnerable to Remote Code Execution RCE by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only...

CVE-2022-30118

Title for CVE: XSS in /dashboard/system/express/entities/forms/savecontrol/GUID: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can...

CVE-2022-30118

Title for CVE: XSS in /dashboard/system/express/entities/forms/savecontrol/GUID: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can...

Judge.me : Improper Access Control in Ali Express Importer

An improper access control vulnerability was found in the Ali Express Review Importer app, which allowed staff members with no access to the Judge.me app to view all reviews, including hidden and archived ones, from the Judge.me app. The vulnerability was exploited by intercepting and replacing t...

Malicious code in express-4.x-passport-snapchat-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d0ca6535a564c08a2ffa5c45fb5ec728ccbdb49e6b49c6dcea0320b08f6bae7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2924 Malicious code in express-4.x-passport-snapchat-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d0ca6535a564c08a2ffa5c45fb5ec728ccbdb49e6b49c6dcea0320b08f6bae7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in brightspot-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cc2e7d673240d37be2cfa9179cabb6362c51e4f5ceefdda9e82337614b40960 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1681 Malicious code in brightspot-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cc2e7d673240d37be2cfa9179cabb6362c51e4f5ceefdda9e82337614b40960 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internal_crypto_express_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06c69db72707e6766450753f29b6bb428f55c0717b1299f0453c9259d92eb613 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2928 Malicious code in express-metrics-zmarta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e6a321bdc56cccc7c6d361c64a3f2f537e49a4bad0b8054a416be2a5db10285 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-metrics-zmarta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e6a321bdc56cccc7c6d361c64a3f2f537e49a4bad0b8054a416be2a5db10285 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2925 Malicious code in express-blackbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3f084bd8ff56a921dd19425589a261461fc8a6d922935dcdb49a5fd2a5ac0ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...