7431 matches found
Malicious Package
Overview postman-echo-nock is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...
BMC Track-It! GetPopupSubQueryDetails SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper...
PT-2022-22975 · Bmc · Bmc Track-It!
Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 20.21.02.109 Description: This issue allows remote attackers to disclose sensitive information on affected installations. Authentication is required to exploit this issue. The specific flaw exists within the...
PT-2022-22976 · Bmc · Bmc Track-It!
Name of the Vulnerable Software and Affected Versions: BMC Track-It! version 20.21.2.109 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the authorization of...
BMC Track-It! HTTP Module Improper Access Control Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prio...
Malicious code in fcskuqoiemhdkwra (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1498f59826547fe0fbb0bd767a6163bf369eb13b432a09194edae0728a588957 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in nqizvyalgkfjtwmx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 298a4ce472d6dadaf650fc224aefbbe994bc72c417d0f825a01c71c8db348184 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in kaymsdxjpukotvhr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2d4a21bfefcd704e8664124a1559285223d714e409d8956653d8fb6c5454577 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in cfltupdwygjikoam (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0b0e2ce78f95a826f3299117c93f43a15f3443919cca0fbedca2577299081e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Rethinking Vulnerability Management in a Heightened Threat Landscape
Mariano Nunez, CEO, Onapsis Repeated warnings from CISA and the Biden Administration on the Russian cyber threat over the last several months have heightened the state of alertness for U.S. agencies and businesses across industries, which are expecting ‘tit-for-tat’ cyberattacks from Russia in...
Remote Code Execution
snipe/snipe-it is vulnerable to remote code execution. The vulnerability exists in the Select User function under the People Menu component which allows an attacker with admin privileges to inject remote code to a user via maliciously crafted pdf files...
How to Quickly Prioritize Risks with VMDR 2.0 and Orchestrate Response with CMDB & ITSM Integration
A single source of truth for asset inventory enables Cybersecurity and IT teams to optimally automate risk prioritization and response. Qualys VMDR 2.0 with TruRiskTM leverages Qualys CSAM to automate the Asset Criticality Score, a key parameter of risk scoring. This blog explains how with insigh...
Arbitrary File Upload
snipe/snipe-it is vulnerable to arbitrary file upload. The vulnerability exists in the store function in AcceptanceController.php due to improper validation of the update branding settings component, allowing an attacker to inject and execute arbitrary code through a maliciously crafted file...
How Shady Code Commits Compromise the Security of the Open-Source Ecosystem
In this blog entry, we discuss how open-source code has been subjected to protest-driven code modifications by its maintainers or backers. We also provide an analysis of what these incidents could mean for the IT industry and the open source community...
GHSA-W82X-XJJR-CJR5 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
GHSA-XWQX-X38C-CW95 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
