Malicious code in ethereumjs-utils-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7a448dcf4eb2492d9c83dbfdf881973de080023a4e269bd314dd6ae113ad159 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mailjet-old-react-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f341e416859da201efd36b62dd26528ba230a7ab134f96c2944b2de103f7179f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Old Age Home Management System 1.0 - SQL injection Authentication Bypass Vulnerability

Exploit Title: Old Age Home Management System 1.0 - SQLi Authentication Bypass Exploit Author: twseptian Vendor Homepage: https://phpgurukul.com/old-age-home-management-system-using-php-and-mysql/ Software Link: https://phpgurukul.com/projects/Old-Age-Home-MS-using-PHP.zip Version: v1.0 Tested on...

Couchbase Server 安全漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in versions of Couchbase Server prior to 7.0.4, which stems from the fact that...

CVE-2022-31481

An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP seri...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities (CVE-2022-0391)

Summary IBM Security SOAR uses an older version of Python 3.6 that may be identified and exploited. An update has been released which addresses these issues. The version of Python included in the latest version of IBM ® Security Soar is 3.8. Vulnerability Details CVEID:CVE-2022-0391 DESCRIPTION:...

MAL-2022-5643 Malicious code in react-dom-router-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 982577f3dd90dc874a760dcdc2288ddccc947f0a8410d5ab383e2350556ca1fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The Mystery of China’s Sudden Warnings About US Hackers

The Chinese government recently began saber-rattling about American cyberespionage. The catch? It’s all old news...

Improper handling of REST API XML deserialization errors in Jenkins

Jenkins provides XML REST APIs to configure views, jobs, and other items. When deserialization fails because of invalid data, Jenkins 2.274 and earlier, LTS 2.263.1 and earlier stores invalid object references created through these endpoints in the Old Data Monitor. If an administrator discards t...

GHSA-QV6F-RCV6-6Q3X Improper handling of REST API XML deserialization errors in Jenkins

Jenkins provides XML REST APIs to configure views, jobs, and other items. When deserialization fails because of invalid data, Jenkins 2.274 and earlier, LTS 2.263.1 and earlier stores invalid object references created through these endpoints in the Old Data Monitor. If an administrator discards t...

GHSA-4HCH-R9XF-6VFR MJML vulnerable to path traversal

MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document...

Snake Keylogger Spreads Through Malicious PDFs

While most malicious e-mail campaigns use Word documents to hide and spread malware, a recently discovered campaign uses a malicious PDF file and a 22-year-old Office bug to propagate the Snake Keylogger malware, researchers have found. The campaign—discovered by researchers at HP Wolf...

Google TensorFlow代码问题漏洞

Google TensorFlow, an end-to-end open source platform for machine learning from Google, Inc. is vulnerable to a code issue in versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which stems from tf.rawops. SparseTensorDenseAdd has incomplete validation for the input parameters. No detailed...

CVE-2022-30688

needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files...

CVE-2022-23666

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager versions: 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability...

GHSA-6MV9-HCX5-7MHH Server-Side Request Forgery in Jenkins

An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response...

[SECURITY] Fedora 35 Update: microcode_ctl-2.1-47.3.fc35

The microcodectl utility is a companion to the microcode driver written by Tigran Aivazian . The microcode update is volatile and needs to be uploaded on each system boot i.e. it doesn't reflash your cpu permanently, reboot and it reverts back to the old microcode...

New APT Group Earth Berberoka Targets Gambling Websites With Old and New Malware

We recently found a new advanced persistent threat APT group that we have dubbed Earth Berberoka aka GamblingPuppet. This APT group targets gambling websites on Windows, macOS, and Linux platforms using old and new malware families...

CVE-2022-1390

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a...

CVE-2022-1384 Authorized users are allowed to install old plugin versions from the Marketplace

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities...