GO-2022-0475 Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious unquoted symbol name in a linked object file...

CVE-2022-2243

An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects...

CVE-2022-2243

An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects...

CVE-2022-2243

Removed by vendor...

PT-2022-15427 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 14.8 through 14.10.4 GitLab EE/CE versions 15.0 through 15.0.3 GitLab EE/CE versions 15.1 through 15.1.0 Description: An access control issue affects GitLab EE/CE, allowing authenticated users to enumerate issues in...

Malicious code in spotify-linkedlist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ccc278f4b02eefacc3f59ffb56eb2c71691ad66975e7469e16e52eb9b021ac9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in resolve-linked (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d36a50ec7a5671b4c6a2183d6844d7e68453b7021417ea7262cce2f0b503fa0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5766 Malicious code in resolve-linked (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d36a50ec7a5671b4c6a2183d6844d7e68453b7021417ea7262cce2f0b503fa0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

China-linked APT Flew Under Radar for Decade

Researchers have identified a small yet potent China-linked APT that has flown under the radar for nearly a decade running campaigns against government, education and telecommunication organizations in Southeast Asia and Australia. Researchers from SentinelLabs said the APT, which they dubbed Aoq...

CVE-2021-36609

Cross Site Scripting XSS vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php...

WordPress Plugin Hot Linked Image Cacher Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Hot Linked Image Cacher version 1.16 and prior versions, which stems fro...

CVE-2022-1765

The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks due to copyright violations or licensing rules...

CVE-2022-1765

The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks due to copyright violations or licensing rules...

CVE-2022-1765

The CVE-2022-1765 entry refers to the WordPress plugin Hot Linked Image Cacher (versions up to 1.16) and describes a CSRF vulnerability that can be used to trigger image upload/cache actions on external domains, potentially causing legal risks due to copyright or licensing issues. The connected d...

CVE-2022-1765 Hot Linked Image Cacher <= 1.16 - Image upload/cache abuse via CSRF

The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks due to copyright violations or licensing rules...

WordPress plugin Hot Linked Image Cacher 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Hot Linked Image Cacher version 1.16 and prior versions, which stems fro...

Privilege Escalation

kernel is vulnerable to privilege escalation. There is a possible linked list corruption in uvcscanchainforward of uvcdriver.c due to an unusual root cause which could lead to a local escalation of privileges in the library with no additional execution privileges needed...

GHSA-4QQ9-QG7J-FCM9 Dolibarr Cross-Site Request Forgery (CSRF)

An issue was discovered in Dolibarr. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer header; howeve...

Dolibarr Cross-Site Request Forgery (CSRF)

An issue was discovered in Dolibarr. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer header; howeve...

Gmail-linked Facebook accounts vulnerable to attack using a chain of bugs—now fixed

A security researcher has disclosed how he chained together multiple bugs in order to take over Facebook accounts that were linked to a Gmail account. Youssef Sammouda states it was possible to target all Facebook users but that it was more complicated to develop an exploit, and using Gmail was...