Malicious code in azuremediaplayer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12ffc5c92710663fe5b679fac46532f7a49df83e0750511ab869d40ddd069fbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Kibana Sensitive Data Disclosure

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connecto...

GHSA-HP5F-QQRW-C8GJ Kibana Sensitive Data Disclosure

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connecto...

GHSA-9PF7-F47Q-MWPQ Cross-site Scripting in RabbitMQ

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious use...

Malicious code in ddc-classnames-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e99acb40e304c7529f780536e9e0c06faa3d8e76d23a1d58b7573005c7b92200 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Aruba ClearPass Policy Manager Remote Command Injection Vulnerability (CNVD-2022-55529)

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. A remote command injection vulnerability in the command line interface of Aruba ClearPass Policy Manager versions 6.10.4 and earlier, 6.9.9 and earlier, and...

Malicious code in dontblowthisoff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf5c38fb9ecda26d5c95ebecbd9228db2f2e33cd6075678b149fcd1ed40e7691 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in systemuser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cdb22bc0a07f98d90b08efd3dedbf7af55fcc0f3097f068e2ec41f1e09f83dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-J76Q-99X2-V7VQ Apache Ambari Improper Access Control

Custom commands may be executed on Ambari Agent 2.4.x, before 2.4.2 hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agen...

GHSA-3F2C-JM6V-CR35 Django DNS Rebinding Vulnerability

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS...

Malicious code in @epc-infra/clinstestpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9960278b8fe842784b23bfe1b25691881cd6b765f159735025d6709ad0ef8dd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in speedy-ts-compiler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e169a7981c2abffdf7307332d399464dd770067c107f40e8a7c7b6c62fe06e3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-62G2-M955-V383 Improper Input Validation in Apache Spark

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A...

Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...

GHSA-HPWM-84H5-VQR8 Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...

GHSA-9773-3FQG-8W25 OpenStack Neutron's unsupported dport option prevents applying security groups

An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option for example, VRRP, an...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388-Exploit Test and Exploit Scripts for CVE 2022-13...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution in the gitserver service. An administrator who is able to edit or add a Gitolite code host and has administrative access to Sourcegraph’s bundled Grafana instance can change this command arbitrarily and run it...

U.S. Dept Of Defense: CVE-2020-3187 - Unauthenticated Arbitrary File Deletion

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...

All-in-One WP Migration < 7.59 - Admin+ File Deletion on Windows Hosts via Path Traversal

The plugin is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the /lib/model/class-ai1wm-backups.php file which can be exploited by administrative users, and users who have access to the site’s secret key on WordPress instances with Windows...