288 matches found
CVE-2022-25921
All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor...
Design/Logic Flaw
All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor...
CVE-2022-25921
CVE-2022-25921 affects the JavaScript package morgan-json . The vulnerability stems from missing sanitization of input passed to the Function constructor, enabling Arbitrary Code Execution . Multiple sources (Snyk, Veracode, GitHub advisories, OSV, CVE list) concur that all versions of morgan-jso...
CVE-2022-25921
All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor...
PT-2022-17605 · Unknown · Morgan-Json
Name of the Vulnerable Software and Affected Versions: morgan-json versions all Description: The issue is related to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor. This allows for potential code execution with unintended consequences. No...
morgan-json 安全漏洞
morgan-json is a variant of morgan.compile by Charlie Robbins, an American personal developer, which provides formatting functions that output JSON. A security vulnerability exists in all versions of morgan-json, which stems from a lack of sanitization of the input passed to the Function...
@amirmarmul/waba-common (>=2.2.51, <=2.9.8), @aptana/multichannel-common (>=2.9.12, <=2.10.3) +14 more potentially affected by CVE-2022-25921 via morgan-json (1.1.0)
morgan-json NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on morgan-json and may be impacted: - @amirmarmul/waba-common =2.2.51, =2.9.12, =1.0.0, =1.1.3, =1.0.0, =1.0.3, =0.11.0, =2.0.0, =0.0.5, =1.0.0, =0.1.0, =1.1.0, =0.0.1, =2.1.5 a...
Arbitrary Code Execution
Overview morgan-json is an A variant of morgan.compile that provides format functions that output JSON Affected versions of this package are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor. PoC js var PUT = require'morgan-json';...
morganclaypoolpublishers.com Cross Site Scripting vulnerability OBB-2617256
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Logistics giant D.W. Morgan exposed 100 GB worth of clients’ data
By Waqas The clients affected by the incident include Global 500 company Ericsson and Fortune 500 company Cisco. This is a post from HackRead.com Read the original post: Logistics giant D.W. Morgan exposed 100 GB worth of clients data...
New CISA Director Confirmed, W.H. Gains Cyber-Director
The U.S. has made a key move to shore up its cybersecurity strategy, with the confirmation of Jen Easterly as the director of the Cybersecurity and Infrastructure Security Agency CISA on Monday. Easterly, a former official at the National Security Agency from 2011 to 2013 and two-time Bronze Star...
Last Week’s Security news: PrintNightmare patches and Metasploit, Kaseya CVEs, Morgan Stanley Accellion FTA, Cisco BPA and WSA, Philips Vue PACS, CISA RVAs, Lazarus job offers
Hello guys! The third episode of Last Week’s Security news, July 5 - July 11. There was a lot of news last week. Most of them was again about PrintNightmare and Kaseya. The updates for PrintNightmare CVE-2021-34527 were finally released mid-week. It became possible not only to disable the service...
GHSA-94HH-PJJG-RWMR Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime
Impact AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown. But a possibly observable difference in timing when padding error would occur while...
Russian Hacker Gets 12-Years Prison for Massive JP Morgan Chase Hack
A U.S. court on Thursday sentenced a 37-year-old Russian to 12 years in prison for perpetrating an international hacking campaign that resulted in the heist of a trove of personal information from several financial institutions, brokerage firms, financial news publishers, and other American...
morgan-multimedia.fr Cross Site Scripting vulnerability OBB-1378147
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
morgan-york.co.uk Cross Site Scripting vulnerability OBB-1367232
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Morgan Stanley Hobbes Out-of-Bounds Read/Write Vulnerability
Morgan Stanley Hobbes is an embedded language compiler and runtime program from Morgan Stanley USA. An out-of-bounds read/write vulnerability exists in Morgan Stanley Hobbes version 2020-05-21 and earlier. The vulnerability stems from a lack of boundary checking in the array implementation. An...
CVE-2020-13656
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...
CVE-2020-13656
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...
Out-of-bounds
In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds OOB read/write vulnerability that leads to both local and remote code via RPC execution...