@activepieces/piece-amazon-s3 (=0.0.2), @adobe/helix-admin-support (>=2.1.22 <=2.1.23) +471 more potentially affected by unknown CVE via fast-xml-parser (=4.2.4)

fast-xml-parser NPM version =4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-parser and may be impacted: - @activepieces/piece-amazon-s3 =0.0.2 - @adobe/helix-admin-support =2.1.22, =9.0.39, =2.1.1, =2.1.15, =1.11.158, =1.0.4-0, =1.2.39-...

Join our digital event to learn what’s new in Microsoft Entra

Editors note 6/15/2023: This blog has been updated to reflect the new date for this event, which is now July 11, 2023. It was previously scheduled for June 20, 2023. In today’s interconnected world, there’s virtually no limit to what technology can help us achieve. Millions of connections happen...

@aws-amplify/geo (>=2.0.13-push-notification-dryrun.43 <=2.0.35-unstable.15353e0.2), @aws-amplify/interactions (>=5.0.13-push-notification-dryrun.43 <=5.1.1-unstable.15353e0.2) +98 more potentially affected by CVE-2023-34104 via fast-xml-parser (>=4.1.3 <=4.2.3)

fast-xml-parser NPM version =4.1.3, =2.0.13-push-notification-dryrun.43, =5.0.13-push-notification-dryrun.43, =1.0.13-push-notification-dryrun.43, =5.0.13-push-notification-dryrun.43, =5.1.3-push-notification-dryrun.43, =1.1.6-exodus.1, =6.2.44, =9.1.0, =9.1.0, =9.53.0 and more Source cves:...

CVE-2023-25729

Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such as downloading files or interacting with software already...

The vulnerability in the ChromeOS Camera browser component of Google Chrome operating systems and ChromeOS/Flex, which allows a hacker to execute arbitrary code.

The vulnerability of the ChromeOS Camera browser component in Google Chrome operating systems and ChromeOS/ChromeOS Flex is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through certain interactions with the user...

White House cyber strategy: leadership is now accountable

The National Cybersecurity Strategy represents one of the most significant market-driving forces in the history of IT. It ushers in a new era of standards, requirements, and best practices that will define how our economy works and how buyers interact with sellers for decades to come...

External calls can be manipulated

Lines of code Vulnerability details Impact By making external calls to untrusted contracts, the sender might manipulate the contract's state and cause unintended behavior. Proof of Concept In the tokenURI and mint functions, the contract makes external calls to ERC721nftContract.tokenURInftID and...

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in Aura, which allows an attacker to convince the user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions, leading to an application cras...

Google Chrome DevTools Component Type Mixing Vulnerability

Google Chrome is a web browser from Google, Inc. A type-mangling vulnerability exists in versions prior to Google Chrome 111.0.5563.64, which stems from a type-mangling issue in the DevTools component. A remote attacker could exploit this vulnerability to cause heap corruption via crafted UI...

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the Overview Mode, which allows an attacker to convince an user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page, leading to an applicati...

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the type confusion in DevTools, which allows an attacker to convince user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions, leading to an application crash...

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the integer overflow in Window Manager, which allows an attacker to convince a user to engage in specific UI interactions to perform an out-of-bounds memory write via crafted UI interaction, leading to an...

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the Exosphere, which allows an attacker to engage the user in specific UI interactions to potentially exploit heap corruption via crafted UI interactions, leading to an application crash...

StabilityPool.sol – Re-entrancy risk on withdrawfromSP()

Lines of code Vulnerability details The withdrawFromSP function in the StabilityPool contract is vulnerable to a reentrancy attack through the sendLUSDToDepositor function. The sendLUSDToDepositor function is vulnerable because it transfers LUSD tokens and LQTY gains before updating state...

LQTYStaking.sol – Reentrancy risk in stake() unstake() functions

Lines of code Vulnerability details In the LQTY smart contract, the stake and unstake functions are used to add or remove a certain amount of LQTY tokens from a user's stake, respectively. Both functions are designed to update the user's stake and the total amount of LQTY staked while allowing...

openSUSE 15 Security Update : opera (openSUSE-SU-2023:0063-1)

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0063-1 advisory. - Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM...

Cross site scripting

Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be...

CVE-2023-22462 Stored XSS in Grafana Text plugin

Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be...

CVE-2023-0932

Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2023-0932

Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...