CVE-2022-31098 Weave GitOps leaked cluster credentials into logs on connection errors

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of...

Buy logic is not correct

Lines of code Vulnerability details Impact This will affect the curves from where the buy need to happen. This will lead to erroneous result. Proof of Concept Tools Used Manual calculation and code review Recommended Mitigation Steps Update the Buy logic by referring the sell logic. --- The text...

PT-2022-22067 · Jenkins · Jenkins Stash Branch Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Stash Branch Parameter Plugin versions 0.3.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which can be exploited by attackers with Item/Configure permission. This occurs because the...

MAL-2022-1549 Malicious code in bfx-reports-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91401ae4d7bf54dad96d13c79dbe2470122cd840dc7ebc1abef3273f3c26c7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1136 Malicious code in assessment-zmarta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45653801bc7c04da5271fafa815874ed3e90695328e763a6415f729f6de09968 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5371 Malicious code in plugin-svgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1341e5c5e07e1379451f4873b4c4fa7b1d05d4cfbd7444c8484145e2dddca09c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @coinalpha/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a7704a85626f889573180f8a0f9209011120627ad9c9481261dd65ca9e3d9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-170 Malicious code in @cirrusinsight/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 359f73ce668f1e232c5f0615e7425ccddbf63c6d7f7932a2d870b3ae3de86ed3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2014-125005 FFmpeg mpeg4videodec.c decode_vol_header memory corruption

A vulnerability, which was classified as problematic, was found in FFmpeg 2.0. This affects the function decodevolheader of the file libavcodec/mpeg4videodec.c. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix...

Design/Logic Flaw

In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded applications for other users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Out-of-bounds

In phNciNfcRecvMfResp of phNxpExtnsMifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2022-31066 Configuration API in EdgeXFoundry exposes message bus credentials to local unauthenticated users

EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, the /api/v2/config endpoint exposes message bus credentials to local unauthenticated users. In security-enabled mode, message bus credentials are supposed to...

Exploit for Authorization Bypass Through User-Controlled Key in Razormist Online_Discussion_Forum_Site

CVE-2022-31295 Online Discussion Forum Site 1.0 - IDOR / Dele...

CVE-2020-36528 Platinum Mobile MobileHandler.ashx access control

A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control. The attack requires authentication. Upgrading to version 1.0.4.851 is able to address this issue. It is recommended to upgrade the...

Exploit for CVE-2022-30190

POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina...

PUB-A-210847407

In exynossecEnvinit of mach-gs101.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-223492713

In asn1p256int of crypto/asn1.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-224932775

In ioctldpmqosupdate and ioctleventcontrolset of TBD, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-220868345

In asn1parse of asn1.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

PUB-A-194694600

In hcisendacl and related functions of hcicore.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...