Malicious Package

Overview @uc-maps/layer-select.react is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

WordPress plugin Google Tag Manager cross-site scripting vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Google Tag Manager version 1.15 has a cross-site scripting vulnerability that stems from the fact that site searches are n...

June 23, 2022—KB5014665 (OS Build 20348.803) Preview

None None...

MAL-2022-680 Malicious code in @uc-maps/layer-select.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e16c28c35ea063cec1fb2f23764d6be10526f72c11c42bc40879a61a2383ff0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-6794 · Unknown +3 · Simple Directmedia Layer +3

Name of the Vulnerable Software and Affected Versions: Simple DirectMedia Layer version 1.2 Description: The issue is related to a use-after-free vulnerability in the XFree function of the /src/video/x11/SDL x11yuv.c component of the Simple DirectMedia Layer library. This vulnerability can be...

Rundeck plaintext storage vulnerability

Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. versions 4.2.0 and 4.2.1 of Rundeck contain a plaintext storage vulnerability that stems from not properly enabling the Key Storage...

PT-2022-6747 · Ericsson +6 · Erlang/Otp +6

Name of the Vulnerable Software and Affected Versions: Erlang/OTP versions prior to 23.3.4.15 Erlang/OTP versions 24.x prior to 24.3.4.2 Erlang/OTP versions 25.x prior to 25.0.2 Description: The issue is related to a Client Authentication Bypass in certain client-certification situations for SSL,...

CVE-2022-31044 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created...

CVE-2022-32156

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

Splunk 信任管理问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Rundeck 安全漏洞

Rundeck is an open source automation service with a Web console, command line tools and WebAPI from Rundeck, Inc. that is primarily used to run automation tasks. versions 4.2.0 and 4.2.1 of Rundeck contain a plaintext storage vulnerability that stems from not properly enabling the Key Storage...

Splunk 信任管理问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

CVE-2022-32557

An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers...

CVE-2021-35130

Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables...

CVE-2021-35083

Possible out of bound read due to improper validation of certificate chain in SSL or Internet key exchange in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdrag...

CVE-2021-35130

CVE-2021-35130 affects Qualcomm components in Snapdragon-based devices (notably in the Display/graphics stack). The issue is memory corruption caused by a use-after-free in the graphics support layer, leading to potential local impact on confidentiality, integrity and availability. The vulnerabil...

CVE-2022-1707

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is /public/frontend.ph...

Cross site scripting

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is /public/frontend.ph...

CVE-2022-1707 Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search

The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is /public/frontend.ph...

CVE-2017-20041

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers URL. It is possible to launch the attack remotely...