CVE-2022-29235

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp...

Lightbend Play Framework 安全漏洞

Lightbend Play Framework is a web application framework written in the Scala language from Lightbend, Inc. A security vulnerability exists in Lightbend Play Framework prior to version 2.8.16, which originates from the easy generation of error messages containing sensitive information...

Lightbend Play Framework 资源管理错误漏洞

Lightbend Play Framework is a web application framework written in the Scala language from Lightbend, Inc. A resource management error vulnerability exists in Lightbend Play Framework versions 2.8.3 through 2.8.15, which results in a denial of service when using the FormbindFromRequest method on...

PT-2022-19485 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions 2.2 through 2.3.17 BigBlueButton versions 2.4-rc-1 through 2.4-rc-5 Description: BigBlueButton is an open source web conferencing system. An attacker who is able to obtain the meeting identifier for a meeting on a serve...

Latest Mobile Malware Report Suggests On-Device Fraud is on the Rise

An analysis of the mobile threat landscape in 2022 shows that Spain and Turkey are the most targeted countries for malware campaigns, even as a mix of new and existing banking trojans are increasingly targeting Android devices to conduct on-device fraud ODF. Other frequently targeted countries...

Android apps with millions of downloads exposed to high-severity vulnerabilities

Microsoft uncovered high-severity vulnerabilities in a mobile framework owned by mce Systems and used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote albeit complex or local attacks. The vulnerabilities, which affected apps...

Android apps with millions of downloads exposed to high-severity vulnerabilities

Microsoft uncovered high-severity vulnerabilities in a mobile framework owned by mce Systems and used by multiple large mobile service providers in pre-installed Android System apps that potentially exposed users to remote albeit complex or local attacks. The vulnerabilities, which affected apps...

by.exonit.redmine.client:client-play26-ws_2.12 (=5.0.0), ch.datascience:renku-commons_2.12 (=0.2.0) +85 more potentially affected by CVE-2019-17598 via com.typesafe.play:play-ws_2.12 (>=2.6.0-M1 <=2.6.23)

com.typesafe.play:play-ws2.12 MAVEN version =2.6.0-M1, =1.0.0, =7.6.0-crosscompilescala212.2.206f1b4play2.6, =10.0.0play2.6, =10.0.0play2.6, =10.0.0play2.6, =0.4.0, =0.4.0, =0.1.0, =0.2.3 - com.elegantmonkeys:lagom-javadsl-google-pubsub-broker2.12 =1.0.0-RC1 -...

GHSA-442G-GCG6-MHM4 Play Framework Inadequate Encryption Strength vulnerability

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host...

Play Framework Inadequate Encryption Strength vulnerability

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host...

GHSA-H5MV-FV98-GQMQ OS command injection vulnerability in Jenkins Play Framework Plugin

A form validation endpoint in Play Framework Plugin executes the play command to validate a given input file. Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by use...

OS command injection vulnerability in Jenkins Play Framework Plugin

A form validation endpoint in Play Framework Plugin executes the play command to validate a given input file. Play Framework Plugin 1.0.2 and earlier lets users specify the path to the play command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by use...

Fake Mobile Apps Steal Facebook Credentials, Cryptocurrency-Related Keys

We recently observed a number of apps on Google Play designed to perform malicious activities such as stealing user credentials and other sensitive user information, including private keys...

com.coherentlogic.fred.client:fred-client-core (=0.9.3), com.coherentlogic.fred.client:fred-client-core-it (=0.9.3) +36 more potentially affected by CVE-2013-6235 via com.jamonapi:jamon (>=1.0 <=2.75)

com.jamonapi:jamon MAVEN version =1.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.1.4, =0.9.0, =0.9.1 and more Source cves: CVE-2013-6235 Source advisory: OSV:GHSA-QPR7-5M63-HQ2Chttps://vulners.com/osv/OSV:GHSA...

GHSA-RVX4-GG8W-QW24 Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs

An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java that allow an attacker to obtain credential IDs. As of version 1.7, enumeration of credentials IDs and validation of specified credentials i...

Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs

An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java that allow an attacker to obtain credential IDs. As of version 1.7, enumeration of credentials IDs and validation of specified credentials i...

Play Framework's Assets controller vulnerable to directory traversal

A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 fixed in 2.6.16 when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests...

ai.snips:play-mongo-bson_2.12 (>=0.5 <=0.5.1), be.venneborg:play26-refined_2.12 (>=0.2.0 <=0.3.0) +154 more potentially affected by CVE-2018-13864 via com.typesafe.play:play_2.12 (>=2.6.12 <=2.6.15)

com.typesafe.play:play2.12 MAVEN version =2.6.12, =0.5, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =1.4-P26-B3, =1.5.13, =7.6.0-crosscompilescala212.2.206f1b4play2.6, =10.0.0play2.6, =10.0.0play2.6, =10.0.0play2.6, =17.1.4play2.6 - com.elegantmonkeys:lagom-google-pubsub-broker2.12 =1.0.0-RC1 and more Source...

GHSA-V4MQ-P756-P4F5 Play Framework's Assets controller vulnerable to directory traversal

A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 fixed in 2.6.16 when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests...

ai.idylnlp:idylnlp-models-deeplearning (>=1.0.0 <=1.1.0), ai.platon.pulsar:pulsar-agentic (>=4.5.0 <=4.6.0) +5848 more potentially affected by CVE-2013-4002 via xerces:xercesImpl (>=2.10.0 <=2.11.0)

xerces:xercesImpl MAVEN version =2.10.0, =1.0.0, =4.5.0, =4.7.11, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0, =4.5.0, =4.5.0, =4.5.0, =0.2, =5.0.9, =5.1.3 and more Source cves: CVE-2013-4002 Source advisory: OSV:GHSA-7J4H-8WPF-RQFH...