Possible shell escape sequence injection vulnerability in Rack

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted...

CVE-2022-31091

Guzzle, an extensible PHP HTTP client. Authorization and Cookie headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the Authorization and Cookie headers...

CVE-2022-31091 Change in port should be considered a change in origin in Guzzle

Guzzle, an extensible PHP HTTP client. Authorization and Cookie headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the Authorization and Cookie headers...

Malicious Package

Overview middleware-serde is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

The vulnerability of the E-Business Suite component – XDO, a software tool for creating reports within the Oracle BI Publisher software platform of the Oracle Fusion Middleware – allows a malicious individual to execute arbitrary code and gain full control over the application.

The vulnerability of the E-Business Suite component – XDO, a software tool for creating reports within the Oracle BI Publisher and the Oracle Fusion Middleware software platform – is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute...

Debian DLA-3057-1 : request-tracker4 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-3057 advisory. - Best Practical Request Tracker RT 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against...

Change in port should be considered a change in origin

Impact Authorization and Cookie headers on requests are sensitive information. On making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the Authorization and Cookie headers from the request, before containing. Previously, we...

CVE-2022-30123

A flaw was found in ruby gem-rack. This flaw allows a malicious actor to craft requests that can cause shell escape sequences to be written to the terminal via rack's Lint middleware and CommonLogger middleware. This issue can leverage these escape sequences to execute commands in the victim's...

PT-2022-20519 · Guzzle · Guzzle

Name of the Vulnerable Software and Affected Versions: Guzzle versions prior to 6.5.8 Guzzle versions prior to 7.4.5 Description: Guzzle, an extensible PHP HTTP client, has a issue where Authorization and Cookie headers on requests are sensitive information. In affected versions, when making a...

Malicious code in mason-auth-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a7e13ffcc348e9c23720985748eb11d9c351ea990d48320c82ea6beac425536 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4487 Malicious code in mason-auth-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a7e13ffcc348e9c23720985748eb11d9c351ea990d48320c82ea6beac425536 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pattern-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e3950a70e613b294964bf7e35359d2838130a3a0084ebb449d37714e9227b4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5230 Malicious code in pattern-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e3950a70e613b294964bf7e35359d2838130a3a0084ebb449d37714e9227b4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in middleware-user-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44b19794566bda4a38dd2d540097a33b1e703d4edd266ebcbf86146a996fb8a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4589 Malicious code in middleware-user-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44b19794566bda4a38dd2d540097a33b1e703d4edd266ebcbf86146a996fb8a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE SLES15 Security Update : rubygem-actionpack-5_1, rubygem-activesupport-5_1 (SUSE-SU-2022:2108-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2108-1 advisory. - The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the...

querymen 安全漏洞

querymen is an individual developer's query string parser middleware for MongoDB, Express, and Nodejs. A security vulnerability exists in querymen that stems from the middleware's susceptibility to prototype contamination...

DEBIAN-CVE-2022-31043

Guzzle is an open source PHP HTTP client. In affected versions Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This ...

Open redirect

Guzzle is an open source PHP HTTP client. In affected versions the Cookie headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, or on making a request to a server which responds with a...

CVE-2022-31043

Guzzle is an open source PHP HTTP client. In affected versions Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This ...