CVE-2022-3023 Use of Externally-Controlled Format String in pingcap/tidb

Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3...

CVE-2022-3023

The CVE-2022-3023 entry relates to a vulnerability in the PingCAP TiDB server where an externally controlled format string is used, affecting TiDB and specifically versions prior to 6.4.0 and prior to 6.1.3. The issue is described as a format-string vulnerability that can lead to unintended behav...

CVE-2022-3023 Use of Externally-Controlled Format String in pingcap/tidb

Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3...

Rocket.Chat SQL Injection Vulnerability

Rocket.Chat, an open source team chat software, is vulnerable to SQL injection, which stems from the application's lack of validation of externally entered SQL statements. An attacker could exploit the vulnerability to retrieve a reset password token via 2fa secret or 2fa secret...

QNAP Photo Station Vulnerability (QSA-22-24)

QNAP Photo Station is prone to an externally controlled reference to a resource vulnerability which is e.g. used by the DeadBolt ransomware campaign. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

QNAP Photo Station Externally Controlled Reference Vulnerability

Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign...

Malicious code in lodashassig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c11b52d0bebdc9f41d5e9a3d2ec22570aee12d1d86b7747a22f307cabddc538 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in clpiboardy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79fc6e7385694d293dc5f6a0d2e48c6cb3c276e6f17563c8c306d1e7096e602a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Business Logic Flaws

OpenZeppelin Contracts has business logic flaws. The vulnerability exists due to a lack of sanitization between cross chains allowing contracts using Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2 to be classified as direct interactions of externally owned accounts EOAs even though the...

Cross site scripting

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2, will classify direct interactions of externally owned accounts EOAs as cross chain calls, even though they are not...

CVE-2022-35916 Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2, will classify direct interactions of externally owned accounts EOAs as cross chain calls, even though they are not...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts prior to version v4.7.2, which stems from the fact that this is a library for secure smart contract development, and that contracts using Arbitrum L2's...

Dompdf 安全漏洞

Dompdf is an HTML to PDF converter. A security vulnerability exists in Dompdf versions prior to 2.0.0, which originates from an externally controlled filename or path...

Malicious code in cnkqebharvwztkgp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e08d189715254fab18f4f63aa200c742e10b83416bd8475a5eb9fd190b8fa75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cwhlbuagoydrspnk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4419d8f25b95696ccb630ced0dc3b157753307d628fdf483c76e7ec50ac221e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Library Management System SQL Injection Vulnerability (CNVD-2022-61297)

Library Management System is a library management system with QR code attendance and automatic library card generation. version 1.0 of Library Management System is vulnerable to SQL injection, which stems from a missing parameter id in the file /librarian/bookdetails.php validation of externally...

Exploit for CVE-2022-30190

CVE-2022-30190EXPPowerPoint This is exploit of CVE-2022-301...

Malicious code in flp-njs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac0e652fc6c9b234a53156b1b8ccbc2664ef37807e3fe5280b14d35ebe299852 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lamalo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de392d36e92faee4d44d4b771757807697a6b4d99e3dd8dff4ff555155a49c14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ta-web-platform/localezone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 007f35ba53a5e20c06b04deb9443ba80f71bbccf8962ae4d064ff6e93dfb967b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...