Malicious code in karma-failed-tests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 936e6328b59bb0287da11b8311dd6a223d84756be95bf201c9e3b87d6c056eb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4110 Malicious code in karma-failed-tests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 936e6328b59bb0287da11b8311dd6a223d84756be95bf201c9e3b87d6c056eb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

_harvest rewards can be stolen because it doesn't implement any slippage bounds

Lines of code Vulnerability details Impact Harvested funds stolen Proof of Concept harvest does not implement any kind of minimum out when calling the 3 consecutive swaps L249, L263 and L275 to get from auraBal to Aura. An attacker could easily sandwich the least liquid pool and steal all the...

LinkedIn: The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more su

example- String username = request.getParameter"username"; String password = request.getParameter"password"; int authResult = authenticateUserusername, password; the security tokens can be bypassed easily , they are dont make user account safe . //script - check attached file Impact Technical...

External contract calls inside loops may result in DoS.

Lines of code Vulnerability details Impact Calls to external contracts inside a loop are dangerous especially if the loop index can be user-controlled because it could lead to DoS if one of the calls reverts or execution runs out of gas. Reference Proof of Concept for uint i = 0; i 0...

GHSA-V969-5V7F-PMG2 TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...

CVE-2022-30600

A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed...

GHSA-9VG9-X38G-9HFX Jenkins allows attackers to determine whether a user exists

The loadUserByUsername function in hudson/security/HudsonPrivateSecurityRealm.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to determine whether a user exists via vectors related to failed login attempts...

Unchecked call in _withdrawFromYieldPool

Lines of code GeneralVault.solL100-L128 LidoVault.solL122-L149 Vulnerability details Impact In the withdrawFromYieldPool function in LidoVault.sol, the receivedETHAmount value is returned before the sent value for the call function is checked on line 142. When withdrawCollateral is called in...

kernel: drm/vmwgfx: Fix stale file descriptors on failed usercopy

A use-after-free vulnerability has been identified in the Linux kernel's VMware graphics driver vmwgfx driver. This flaw occurs during the usercopy operation for the fencerep object. If this operation fails, it can leave a stale dangling file descriptor in the system's file descriptor table. This...

NewStart CGSL CORE 5.05 / MAIN 5.05 : bind Vulnerability (NS-SA-2022-0041)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has bind packages installed that are affected by a vulnerability: - In BIND 9.8.5 - 9.8.8, 9.9.3 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of BIND 9 Supported Preview Editio...

Batch Transfer will likely fail on ERC777 transfers, either maliciously or accidentally

Lines of code Vulnerability details Impact If users attempt to bridge ERC777s from Cosmos to Ethereum, it is highly likely that the transfers will revert. The issue lies in the combination of using safeTransfer and the idea of batching. safeTransfer will revert for any failed transfer meaning tha...

Denial of service

In GPAC 2.1-DEV-rev87-g053aae8-master, function BSReadByte in utils/bitstream.c has a failed assertion, which causes a Denial of Service. This vulnerability was fixed in commit 9ea93a2...

ThoughtWorks GoCD Cross-Site Scripting Vulnerability

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A cross-site scripting vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which can be exploited by an attacker controlling a GoCD agent to plant malicious JavaScript into a failed job report...

CVE-2021-43288

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...

CVE-2021-43288

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...

CVE-2021-43288

An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...

ThoughtWorks GoCD 跨站脚本漏洞

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A cross-site scripting vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which can be exploited by an attacker controlling a GoCD agent to plant malicious JavaScript into a failed job report...

XSS affecting "Logs" Page

Description A review of organizr's logging system found it is possible for an unauthenticated threat actor to inject arbitrary JavaScript into the "Logs" page found within the administrator dashboard. In a default installation organizr is set to log failed login attempts. In these attempts, the...

GSD-2022-1000717 cifs: fix double free race when mount fails in cifs_get_root()

cifs: fix double free race when mount fails in cifsgetroot This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.13 by commit...