MAL-2022-247 Malicious code in @epc-libraries/kinesis-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2395684a2ae7565ee6ee411ffbdf038c8b48b3c3a2ffe473e90087627b114bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @epc-libraries/data-api-versions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f82fc77aff4c8f44ec626ff023762b926e5407f3b269db521d9006777e956242 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.10 / 2.332.2.6 Multiple Vulnerabilities (CloudBees Security Advisory 2022-04-12)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.303.x prior to 2.303.30.0.10, or 2.x prior to 2.332.2.6. It is, therefore, affected by multiple vulnerabilities, including the following: - Jenkins Pipeline: Shared Groovy Libraries Plugin...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +5777 more potentially affected by CVE-2013-2186 via commons-fileupload:commons-fileupload (>=1.0 <=1.3.1-jenkins-2)

commons-fileupload:commons-fileupload MAVEN version =1.0, =1.1, =0.0.1, =1.0, =1.0, =3.1.1, =0.0.1, =0.3.15 and more Source cves: CVE-2013-2186 Source advisory: OSV:GHSA-QX6H-9567-5FQW...

com.github.sakserv:hadoop-mini-clusters (=0.0.14), de.m3y.oozie.prometheus:oozie-prometheus-job-event-listener (>=1.0 <=1.2) +10 more potentially affected by CVE-2017-15712 via org.apache.oozie:oozie-core (>=4.1.0 <=4.2.0)

org.apache.oozie:oozie-core MAVEN version =4.1.0, =1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.1.0, =4.2.0 - org.kitesdk:kite-data-oozie =1.1.0 Source cves: CVE-2017-15712 Source advisory: OSV:GHSA-2FX6-R6QX-3C7H...

GHSA-V6FP-H79X-9RQC phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution

phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...

com.aripd:aricl (=1.4), com.aripd:aricom (=1.0) +92 more potentially affected by CVE-2013-5855 via org.glassfish:javax.faces (>=2.2.0 <=2.2.20)

org.glassfish:javax.faces MAVEN version =2.2.0, =3.2.1036, =1.0.0, =1.0.0, =1.6.0, =1.7.0, =1.6.0, =1.7.0, =1.2.0, =1.0.0, =1.7.3 and more Source cves: CVE-2013-5855 Source advisory: OSV:GHSA-3M3R-82GC-53MJ...

com.coherentlogic.fred.client:fred-client-core (=0.9.3), com.coherentlogic.fred.client:fred-client-core-it (=0.9.3) +36 more potentially affected by CVE-2013-6235 via com.jamonapi:jamon (>=1.0 <=2.75)

com.jamonapi:jamon MAVEN version =1.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.1.4, =0.9.0, =0.9.1 and more Source cves: CVE-2013-6235 Source advisory: OSV:GHSA-QPR7-5M63-HQ2Chttps://vulners.com/osv/OSV:GHSA...

ca.stellardrift.guice-backport.extensions:guice-struts2 (=5.0.1), com.google.inject.extensions:guice-struts2 (>=3.0 <=5.0.1) +63 more potentially affected by CVE-2012-0838 via org.apache.struts.xwork:xwork-core (>=2.2.1 <=2.2.3)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =3.0, =2.4.0, =2.4.0, =3.0.0, =3.0.0, =2.4.0, =2.4.0, =2.4.0, =3.0.0, =2.0.0, =0.9.2, =0.9.0, =0.9.1 - io.forestframework:guice-struts2 =5.0.1.1 and more Source cves: CVE-2012-0838 Source advisory: OSV:GHSA-MWRX-HX6X-3HHV...

ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0 <=1.1.0), be.objectify:deadbolt-core_2.10 (>=2.2.0 <=2.4.3) +1203 more potentially affected by CVE-2014-3558 via org.hibernate:hibernate-validator (>=5.0.0.Alpha1 <=5.1.1.Final)

org.hibernate:hibernate-validator MAVEN version =5.0.0.Alpha1, =1.0.0, =2.2.0, =2.4.0, =2.2.0, =2.4.0, =2.2.0, =2.4.0, =2.0.0, =4.0.0.Final, =4.3.0-beta-3 - br.com.caelum:vraptor-musicjungle =4.0.0-beta-1 - br.com.ingenieux.dropwizard:dropwizard-envvar =0.0.1 -...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=0.4 <=0.5), ch.ralscha:extdirectspring (=1.4.0) +75 more potentially affected by CVE-2014-1904 via org.springframework:spring-webmvc (>=4.0.0.RELEASE <=4.0.1.RELEASE)

org.springframework:spring-webmvc MAVEN version =4.0.0.RELEASE, =0.4, =0.1.1-alpha, =0.2-alpha, =1.0.0, =2.0.3.2.1, =2.1.3.10.1, =2.0.3.6, =2.0.3.6, =2.1.2.7.1, =2.0.3.1, =2.1.4.19 and more Source cves: CVE-2014-1904 Source advisory: OSV:GHSA-FF7P-JQJM-V66H...

ar.com.onready:spring-resttemplate-logger (=1.0.2), at.molindo.social:spring-social-config (=1.1.0.RELEASE) +923 more potentially affected by CVE-2014-3578 via org.springframework:spring-core (>=4.0.0.RELEASE <=4.0.4.RELEASE)

org.springframework:spring-core MAVEN version =4.0.0.RELEASE, =1.0.0, =0.9.0-1, =0.4, =1.4.0, =1.0.0, =0.0.2, =1.5.0.20171107, =1.6.1.20180301 - com.allenru:cross-origin =1.0.1 and more Source cves: CVE-2014-3578 Source advisory: OSV:GHSA-RHCG-RWHX-QJ3J...

ar.com.fdvs:DynamicJasper (>=5.0.9 <=5.1.0), ar.com.jmfsg:api-doc (>=0.0.20 <=0.0.34) +6838 more potentially affected by CVE-2014-3578 via org.springframework:spring-core (>=3.0.0.RELEASE <=3.2.8.RELEASE)

org.springframework:spring-core MAVEN version =3.0.0.RELEASE, =5.0.9, =0.0.20, =1.1.0.RELEASE, =1.0.0-alpha-1, =0.3.3, =1.0, =1.0, =0.7, =3.0.1.Final, =0.1, =2.1.7, =2.0, =1.1.1, =1.0.2, =1.1.2 and more Source cves: CVE-2014-3578 Source advisory: OSV:GHSA-RHCG-RWHX-QJ3J...

be.objectify:objectify-struts2-tags (=1.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0 <=2.0.8) +207 more potentially affected by CVE-2014-0112 via org.apache.struts:struts2-core (>=2.0.5 <=2.3.1.2)

org.apache.struts:struts2-core MAVEN version =2.0.5, =2.0.0, =1.2.1, =1.5.3, =1.5.3, =0.5.9, =1.2.0, =1.0.0, =2.0, =1.0.3, =1.2.2, =1.4.0 and more Source cves: CVE-2014-0112 Source advisory: OSV:GHSA-PRJV-JJ26-WF8H...

Debian DLA-3006-1 : openjdk-8 - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3006 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are Oracle...

CentOS: Security Advisory for java (CESA-2022:1487)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Installer of Trend Micro HouseCall for Home Networks may insecurely load Dynamic Link Libraries

Overview Trend Micro Incorporated has released a security update for HouseCall for Home Networks. Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. Impact Installer of Trend Micro HouseCall for Home Networks contains an issue with the D...

ca.ibodrov.concord:testcontainers-concord (>=0.0.2 <=0.0.20), ca.ibodrov.concord:testcontainers-concord-core (>=0.0.21 <=2.0.2) +231 more potentially affected by CVE-2017-7561 via org.jboss.resteasy:resteasy-jaxrs (=3.1.4.Final)

org.jboss.resteasy:resteasy-jaxrs MAVEN version =3.1.4.Final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.resteasy:resteasy-jaxrs and may be impacted: - ca.ibodrov.concord:testcontainers-concord =0.0.2, =0.0.21, =0.0.2, =0.0.1, =1.0.6.Fina...

GHSA-5868-G58J-VRJ5 phpMyAdmin Improper Privilege Management

An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg'Servers'$i'AllowNoPassword' = false are bypassed under certain PHP versions e.g., version 5. This can allow the login of users who have no...

com.actiontestscript:ats-automated-testing (>=1.1.1 <=1.7.8), com.actiontestscript:automated-testing (=1.1.1) +1 more potentially affected by CVE-2017-3202 via com.exadel.flamingo.flex:amf-serializer (=1.5.0)

com.exadel.flamingo.flex:amf-serializer MAVEN version =1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.exadel.flamingo.flex:amf-serializer and may be impacted: - com.actiontestscript:ats-automated-testing =1.1.1, =1.7.8 -...