CVE-2023-47620 Scrypted reflected Cross-site Scripting vulnerability

Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the owner' and 'pkg parameters. An attacker can run arbitrary JavaScript code...

PT-2023-30517 · Scrypted · Scrypted

Name of the Vulnerable Software and Affected Versions: Scrypted versions 0.55.0 and prior Description: A reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the owner and pkg parameters, allowing an attacker to run arbitrary JavaScript code. This issue may lead to...

CVE-2023-47620: Improper Neutralization of Input During Web Page Generation

Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the owner' and 'pkg parameters. An attacker can run arbitrary JavaScript code...

CVE-2023-46737

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

PT-2023-30177

Name of the Vulnerable Software and Affected Versions Cosign versions prior to 2.2.1 Description The issue is a denial of service vulnerability that can be exploited by an attacker who controls a remote registry. The attacker can return a high number of attestations and/or signatures to Cosign,...

CVE-2023-46737: Uncontrolled Resource Consumption

Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Cosign to enter a long loop resulting in...

free5GC udm vulnerable to Invalid Curve Attack

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...

GHSA-CQVV-R3G3-26RF free5GC udm vulnerable to Invalid Curve Attack

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...

CVE-2023-46324

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...

CVE-2023-46324: Improper Verification of Cryptographic Signature

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...

Privilege escalation

An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...

CVE-2023-41902

An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...

CVE-2023-41902

CVE-2023-41902 affects CoreCode MacUpdater prior to 2.3.8 and 3.x prior to 3.1.2. An XPC misconfiguration allows privilege escalation by processing crafted malicious .pkg files. Impacts include local attacker access to escalate privileges; no exploitation details are provided in the documents. Re...

CVE-2023-41902: Unrestricted Upload of File with Dangerous Type

An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...

Malicious code in betterbit-frame-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53eac7cc9bba8053669c385b94e164e86f694e7bfe956ed4c6f89e4f45b43149 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in betterbit-frame-pkg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-7967 Malicious code in @manomano-internal/toolbox-pkg-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fc7979e3934ed11d3e174bef1c18bbc67bc57dbce890460d07d7ee1e2d60d68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @manomano-internal/toolbox-pkg-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in test-dr-pkg-001 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d511e9d40183359a36594e6f9c61d50195d8e1686197d6e9aded6ba780e8fda6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in test-dr-pkg-001

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...