QNAP Photo Station Vulnerability (QSA-22-24)

QNAP Photo Station is prone to an externally controlled reference to a resource vulnerability which is e.g. used by the DeadBolt ransomware campaign. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2022-27593: Externally Controlled Reference to a Resource in Another Sphere

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later...

QNAP Photo Station Externally Controlled Reference Vulnerability

Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign...

Malicious code in lodashassig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c11b52d0bebdc9f41d5e9a3d2ec22570aee12d1d86b7747a22f307cabddc538 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in clpiboardy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79fc6e7385694d293dc5f6a0d2e48c6cb3c276e6f17563c8c306d1e7096e602a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Business Logic Flaws

OpenZeppelin Contracts has business logic flaws. The vulnerability exists due to a lack of sanitization between cross chains allowing contracts using Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2 to be classified as direct interactions of externally owned accounts EOAs even though the...

Cross site scripting

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2, will classify direct interactions of externally owned accounts EOAs as cross chain calls, even though they are not...

CVE-2022-35916 Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, CrossChainEnabledArbitrumL2 or LibArbitrumL2, will classify direct interactions of externally owned accounts EOAs as cross chain calls, even though they are not...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts prior to version v4.7.2, which stems from the fact that this is a library for secure smart contract development, and that contracts using Arbitrum L2's...

Dompdf 安全漏洞

Dompdf is an HTML to PDF converter. A security vulnerability exists in Dompdf versions prior to 2.0.0, which originates from an externally controlled filename or path...

Malicious code in cnkqebharvwztkgp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e08d189715254fab18f4f63aa200c742e10b83416bd8475a5eb9fd190b8fa75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cwhlbuagoydrspnk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4419d8f25b95696ccb630ced0dc3b157753307d628fdf483c76e7ec50ac221e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Library Management System SQL Injection Vulnerability (CNVD-2022-61297)

Library Management System is a library management system with QR code attendance and automatic library card generation. version 1.0 of Library Management System is vulnerable to SQL injection, which stems from a missing parameter id in the file /librarian/bookdetails.php validation of externally...

Exploit for CVE-2022-30190

CVE-2022-30190EXPPowerPoint This is exploit of CVE-2022-301...

Malicious code in flp-njs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac0e652fc6c9b234a53156b1b8ccbc2664ef37807e3fe5280b14d35ebe299852 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lamalo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de392d36e92faee4d44d4b771757807697a6b4d99e3dd8dff4ff555155a49c14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ta-web-platform/localezone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 007f35ba53a5e20c06b04deb9443ba80f71bbccf8962ae4d064ff6e93dfb967b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in typescript3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7dce25aadea9515ee976e94256162853f1bc1af2901141b04abe7ddee27deb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dellingr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 031ba87e7ad2526cbbb19fb538e64c2f512461f10af5a3bf6130fb3de83559ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alicloud-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca2c912f37c0dabe4e08c7168a7267807e4d00151f93c72cc2eed3f371c92d6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...