CVE-2022-37424

CVE-2022-37424 concerns OpenNebula on Linux. The vulnerability arises from the FILES directive, which may allow arbitrary files from the frontend system (including sensitive files) to be included when a VM is started from a template, potentially causing Information Disclosure. Affected details (s...

CVE-2022-23768

This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device...

PT-2022-5098 · Unknown · Nis-Hap11Ac

Name of the Vulnerable Software and Affected Versions: NIS-HAP11AC affected versions not specified Description: The issue is related to insufficient access control in the NIS-HAP11AC wireless access point firmware. It allows a remote attacker to execute arbitrary code via the external telnet port...

Malicious code in crsosspsawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5828716e5e9932309d545a02aede3d1cc990b8b019ef2f1e2811ee3169b382e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exposure of critical functions

Lines of code Vulnerability details Impact AdminRole mixin exposes critical functions without any restrictions like grantAdmin revokeAdmin Proof of Concept Criticial functions like grantAdmin can be externally accessed changing the critical roles like admin. // for eg: function grantAdminaddress...

PT-2022-23989 · Unknown · Opennebula

Name of the Vulnerable Software and Affected Versions: OpenNebula affected versions not specified Description: The issue allows files or directories to be accessible to external parties, enabling file discovery. This affects OpenNebula on Linux. Recommendations: At the moment, there is no...

Malicious code in identity-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dde25fc414a1b79770a05f254f717a98c8b648dd939d6b12dc573aef2e48c29f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dodo-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46dc32b64a228596246662622015254a4093d3c5ca89a8e7d4b74cccacfdd273 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fbpay/merchant-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff532b8bb4d8394da283651d098a5f4b99d05a8cb40e0417ea040d71fc80b35b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6150 Malicious code in skip-reason-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a30343b31f58eb174f1fed869a1b744f9f733741eb22676357e09395c169212 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gd-gplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad19445719b98b693d33cef4e6a46e514a7813cc3b50f6efccf6292275dba6c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS12 certificate...

GHSA-CCMR-QJ26-845G Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

CVE-2022-26665

An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform before 17.1.20. This may allow an external party to access sensitive case records...

CVE-2022-26665

An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform before 17.1.20. This may allow an external party to access sensitive case records...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

PT-2022-9172 · Red Hat · Openshift Container Platform 4

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform 4 affected versions not specified Description: It was found that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623...

PHPUnit Command Injection Vulnerability

PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI...