text_helpers uses web link to untrusted target with window.opener access

A vulnerability was found in ahorner text-helpers 1.1.0/1.1.1. It has been declared as critical. This vulnerability affects unknown code of the file lib/texthelpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The...

PT-2022-9019 · Ahorner · Text-Helpers

Name of the Vulnerable Software and Affected Versions: ahorner text-helpers versions up to 1.0.x ahorner text-helpers versions 1.1.0 through 1.1.1 Description: A critical issue affects the unknown code of the file lib/text helpers/translation.rb. The manipulation of the link argument leads to the...

CVE-2020-36624

Affected software/component: ahorner text-helpers (up to 1.0.x; patch lines reference 1.1.x) with vulnerable code in lib/text_helpers/translation.rb. Root cause: manipulation of the link argument leads to use of a web link to an untrusted target with window.opener access (reverse tabnabbing style...

PT-2022-27331 · Binbloom · Binbloom

Name of the Vulnerable Software and Affected Versions: Binbloom version 2.0 Description: A heap buffer overflow was discovered in Binbloom via the read pointer function at /binbloom-master/src/helpers.c. This issue may be exploited, but details about the estimated number of potentially affected...

Binbloom 缓冲区错误漏洞

Binbloom is an open source tool from Quarkslab. It is used to analyze raw binary firmware and automatically determine some of its characteristics. A security vulnerability exists in Binbloom version 2.0, which originates from a heap buffer overflow contained in the readpointer function via...

kernel: bpf: Fix request_sock leak in sk lookup helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

The vulnerability of the implementation of the recursive rendering function for the Mustache helper components in the Moodle template system allows attackers to perform cross-site scripting attacks or cause service failures.

The vulnerability of the recursive rendering implementation of the Mustache helper components in the Mustache template system of the virtual training environment Moodle is related to improper validation of input data. Exploiting this vulnerability allows an attacker to perform cross-site scriptin...

SUSE SLES12 Security Update : squid (SUSE-SU-2022:3532-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3532-1 advisory. - CVE-2022-41317: Fixed exposure of sensitive information in cache manager bsc1203677. - CVE-2022-41318: Fixed buffer overread in...

squid: buffer-over-read in SSPI and SMB authentication

A flaw was found in Squid. An incorrect integer overflow protection in the Squid SSPI and SMB authentication helpers is vulnerable to a buffer overflow attack, resulting in information disclosure...

CVE-2022-37248

Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting XSS via src/helpers/Cp.php...

Cross site scripting

Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting XSS via src/helpers/Cp.php...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from the US company Pixel & tonic. A cross-site scripting vulnerability exists in Craft CMS version 4.2.0.1, which stems from a security issue in the src/helpers/Cp.php page...

SUSE-SU-2022:3154-1 Security update for udisks2

This update for udisks2 fixes the following issues: - CVE-2021-3802: Fixed insecure defaults in user-accessible mount helpers bsc1190606. - Fixed vulnerability that allowed mounting ext4 devices over existing entries in fstab bsc1098797...

GSD-2022-1004153 drm/aperture: Run fbdev removal before internal helpers

drm/aperture: Run fbdev removal before internal helpers This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.13 by commit...

Malicious Package

Overview coldstone-helpers is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

JerryScript memory mis-reference vulnerability

JerryScript is a lightweight JavaScript engine from the Jerryscript project. version 2.4.0 of JerryScript is vulnerable to a memory misquoting vulnerability that originates in ecma-helpers- in ecmacompareecmanondirectstrings. string.c:1940, which is responsible for freeing memory, is garbled. An...

MAL-2022-2618 Malicious code in dustjs-linkedin-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 873bc4ced308a324a98fca026bd90202448ab5890c03760bfddfee7251a7211e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dustjs-linkedin-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 873bc4ced308a324a98fca026bd90202448ab5890c03760bfddfee7251a7211e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @boosted-bounty/firebase-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a118911f03aac1a4a4258e57d888ff6d41091eb0eaa8473b1ff1fbd2db4225d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @boosted-bounty/firebase-helpers-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 948a8d680d689630aad1614e4a8b58cad4c431fb2d9e87887c4055879595ae95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...