CVE-2023-28895 Hard-coded password for access to power controller chip memory

The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...

CVE-2023-46385

LOYTEC electronics GmbH LINX Configurator all versions is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration...

CVE-2023-46383

LOYTEC electronics GmbH LINX Configurator all versions uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration...

CVE-2023-46383

LOYTEC electronics GmbH LINX Configurator all versions uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration...

LOYTEC electronics GmbH LINX Configurator Security Breach

LOYTEC electronics GmbH LINX Configurator is a tool from the Austrian company LOYTEC electronics GmbH for configuring and managing devices on its LINX platform. A security vulnerability in LOYTEC electronics GmbH LINX Configurator version 7.4.10, which stems from the use of base64-encoded clearte...

Malicious code in arubawebappbackend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13e80ca401e27abd48a78b1577012b1f0eb9ac284b98ca33db5eb920ce9ab41b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4707252020cd550543cb451c800321561d678699d3436d86de8dacbb22c6c32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8544 Malicious code in linktr.ee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99705723baa67b6d8e8af0802429709ea34477b6fc4e6e5d676244e7a042375c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-5984

A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in full control over the device...

Malicious code in djsmusicccsz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed665017a997e34358546e65d661b61814f370cddf415c746b5506036e203ac2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in share-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba664ab24090b0fcbea9d3c7c58134f47472535eba4ff9d4a65946aa5efad8ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in airslate-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a38e9b5638e56d7f1a1fb5d3d5d396fc0a8aee158c609b74bce384f3a4d79cd5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test-pocbb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e66ee4b6ba03a55ffa1a602d967a703bf188cbca24afe3837babd04c6ad152c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Storage Ceph is vulnerable to authentication bypass by spoofing in Grafana (CVE-2022-35957)

Summary Grafana is used by IBM Storage Ceph as part of the dashboard to monitor the stats for each cluster. CVE-2022-35957 Vulnerability Details CVEID: CVE-2022-35957 DESCRIPTION: Grafana could allow a remote authenticated attacker to gain elevated privileges on the system. By sending a specially...

CVE-2023-5754

Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

Default credentials

Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

Malicious code in n-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da3eea908e1ac1801f4b2bfda0ee3333942a9af0f46e5f4e2b41de2a2b8d9b66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in so-loader-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 404b6971c77426e284e330430c8b8f418e3a0622bc881dbc1dae7b32264ee032 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eeddffrrvvrr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7afdfe5e3bb61da148efdfb6b6c94261c8955ad179766fbc82a55883fca6b411 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-horizon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edf204dbf60840297b627dddc89859ee1cae2d2104608731665d180291a0074f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...