CVE-2022-30624 Chcnav - P5E GNSS Authentication bypass admin password reset

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password...

CVE-2022-30624

CVE-2022-30624 affects Chcnav P5E GNSS. Browsing the admin.html page allows resetting the admin password, and the capability is also present in the JavaScript code for the password. This vulnerability is documented across multiple sources (NVD, CVE List, CNNVD, PRION/PRIO pages, ENISA EUVD) indic...

Malicious code in discord.js-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62488af56327cd0a22202bb93f65eff0b4070ab64d1c9a6197f8030c66504bf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora: Security Advisory for golang-github-tdewolff-minify (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-30622 Chcnav - P5E GNSS Information disclosure

Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sysusernamepasswd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within...

[SECURITY] Fedora 35 Update: golang-github-tdewolff-minify-2.11.10-3.fc35

Minify is a minifier package written in Go. It provides HTML5, CSS3, JS, JSON, SVG and XML minifiers and an interface to implement any other minifier. Minification is the process of removing bytes from a file such as whitespace without changing its output and therefore shrinking its size and...

AZL-44553 CVE-2022-25858 affecting package js-jquery 3.5.0-4

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure usage of regular expressions...

OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager Relates to - https://github.com/artf/grapesjs/issues/4411 Patch Update GrapeJS dependency to =v0.19.5...

DEBIAN-CVE-2022-32214

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...

UBUNTU-CVE-2022-32215

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS...

UBUNTU-CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

UBUNTU-CVE-2022-32212

A OS Command Injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks...

Malicious code in ugentec-framework-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a91b6a72d36e1f86952649dd1acf051dd8bc358d059c4ebe50b229b77170ece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the Node.js module and the control tools of App Connect Enterprise Certified Container allows a hacker to compromise protected information.

The vulnerability of the Node.js module related to the App Connect Enterprise Certified Container management tool is linked to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to compromise protected information...

Malicious code in vue3-babel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5cac02007b4690bac994eb4568b35a36b6b8e314560aaec41466da2895e6fd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6999 Malicious code in vue3-babel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5cac02007b4690bac994eb4568b35a36b6b8e314560aaec41466da2895e6fd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

parse-url cross-site scripting vulnerability

parse-url is an advanced url parser with git url support. A cross-site scripting vulnerability exists in parse-url versions prior to 7.0.0, which stems from the ability to run malicious JS code using ASCII characters starting with and all special escape characters starting with Unicode, which can...

PT-2022-3606 · Node.Js +8 · Node.Js +8

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 14.20.1 Node.js versions prior to 16.17.1 Node.js versions prior to 18.9.1 Description: The issue is related to the llhttp parser in the http module in Node.js, which does not strictly use the CRLF sequence to delimi...

Malicious code in ionicons-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9725c2ec0d19615a1adbf6262aa004b3b33803b68c6e24ff76a29f4d21a59d37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3933 Malicious code in ionicons-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9725c2ec0d19615a1adbf6262aa004b3b33803b68c6e24ff76a29f4d21a59d37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...