PYSEC-2022-199

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items when instantiating Ctx objects...

PYSEC-2022-199

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items when instantiating Ctx objects...

org.jenkins-ci.main:jenkins-test-harness (1.444), org.jenkins-ci.main:jenkins-war (1.444) +10 more potentially affected by CVE-2021-21615 via org.jenkins-ci.main:jenkins-core (1.444)

org.jenkins-ci.main:jenkins-core MAVEN version 1.444 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.444 - org.jenkins-ci.main:jenkins-war 1.444 -...

org.jenkins-ci.main:jenkins-test-harness (1.444), org.jenkins-ci.main:jenkins-war (1.444) +10 more potentially affected by CVE-2021-21610 via org.jenkins-ci.main:jenkins-core (1.444)

org.jenkins-ci.main:jenkins-core MAVEN version 1.444 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.444 - org.jenkins-ci.main:jenkins-war 1.444 -...

GHSA-QV6F-RCV6-6Q3X Improper handling of REST API XML deserialization errors in Jenkins

Jenkins provides XML REST APIs to configure views, jobs, and other items. When deserialization fails because of invalid data, Jenkins 2.274 and earlier, LTS 2.263.1 and earlier stores invalid object references created through these endpoints in the Old Data Monitor. If an administrator discards t...

CSRF vulnerability in Jenkins Shared Objects Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects...

GHSA-2V9X-GPQ4-8GG2 CSRF vulnerability in Jenkins Shared Objects Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects...

GHSA-HHPM-74PM-HF35 ingress-nginx component for Kubernetes allows file overwrite

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace ...

GHSA-V377-8F8F-532H Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution

In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity...

GHSA-853F-X27W-8R74 OpenNMS Horizon RCE via Unsafe Deserialization

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

Plone SQL Injection Vulnerability

SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...

USN-5440-1 postgresql-10, postgresql-12, postgresql-13, postgresql-14 vulnerability

Alexander Lakhin discovered that PostgreSQL incorrectly handled the security restricted operation sandbox when a privileged user is maintaining another user's objects. An attacker having permission to create non-temp objects can use this issue to execute arbitrary commands as the superuser...

May 24, 2022—KB5014021 (OS Build 20348.740) Preview

None None...

PT-2022-4932

Name of the Vulnerable Software and Affected Versions SAP Business Objects version 420 Description The issue is related to insufficient input validation, allowing an authenticated attacker to submit a malicious request through an allowed operation. This can result in an attacker being able to vie...

Snake Keylogger Spreads Through Malicious PDFs

While most malicious e-mail campaigns use Word documents to hide and spread malware, a recently discovered campaign uses a malicious PDF file and a 22-year-old Office bug to propagate the Snake Keylogger malware, researchers have found. The campaign—discovered by researchers at HP Wolf...

Mozilla Firefox and Thunderbird Type Confusion Vulnerability

Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash...

Microsoft Windows Kernel Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions...

Microsoft Internet Explorer Information Disclosure Vulnerability

An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk...

Regexp Class Ruby DoS

The vulnerability of the Regexp class implementation in the Ruby programming language is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to cause a service failure through specially created objects of the Regexp class...

CVE-2021-37695

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using...