CVE-2022-44054

The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-utility package. The affected version of d8s-htm is 0.1.0...

CVE-2022-43304

The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-uuids package. The affected version of d8s-htm is 0.1.0...

CVE-2022-43303

The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-uuids package. The affected version of d8s-htm is 0.1.0...

CVE-2022-43306

The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-dates package. The affected version of d8s-htm is 0.1.0...

Malicious code in edit_session (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5262a7b3f13c75a5fffc355c0d48d11e4225a31fdc940e73cddd14429be60c83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Latest on OpenSSL 3.0.7 Critical Bug & Security-Fix

Potential disruptions following vulnerabilities found in OpenSSL...

Owner can bypass reward token protection in recoverERC20 to instantly steal all tokens in contract

Lines of code Vulnerability details Description WardenPledge contract has a sweeping function recoverERC20 to handle mistakenly sent ERC20 tokens: function recoverERC20address token external onlyOwner returnsbool ifminAmountRewardTokentoken != 0 revert Errors.CannotRecoverToken; uint256 amount =...

Oracle Linux 7 : firefox (ELSA-2022-6711)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-6711 advisory. - Added expat backports of CVE-2022-25235, CVE-2022-25236 and CVE-2022-25315 - Added fix for mozbz1348168/CVE-2017-5428 Tenable has extracted the...

Optimistic bridging pattern, can lead to bridge exploitation

Lines of code Vulnerability details Impact Zero deposit Bridging. Wherease users can fake the depositing process but can mint multiple tokens in the destination chain. The bridging is optimistic, whereas the validation restricts to just checking the function selector and a no-error pattern, this...

PT-2022-26671 · Autodesk · Designreview.Exe

Name of the Vulnerable Software and Affected Versions: DesignReview.exe affected versions not specified Description: A maliciously crafted dwf or .pct file consumed through the DesignReview.exe application could lead to a memory corruption issue due to a read access violation. This issue, when...

GHSA-MF4P-WJRM-CMJP AWS secrets displayed without masking by Jenkins S3 Explorer Plugin

S3 Explorer Plugin stores AWSSECRETACCESSKEY in its global configuration file s3explorer.xml on the Jenkins controller as part of its configuration. While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the...

CVE-2022-35829

creationtimestamp| type| source ---|---|--- 2022-10-19 05:00:00+00:00| seen| https://msrc.microsoft.com/blog/2022/10/awareness-and-guidance-related-to-potential-service-fabric-explorer-sfx-v1-web-client-risk/ 2023-01-05 21:55:21+00:00| published-proof-of-concept| https://t.me/RESOLUTEATTACK/316...

HP PC BIOS October 2022 PCR Measurement Update

A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability. Intel has released updates to mitigate the potential vulnerabilities. HP has identified...

expat: a use-after-free in the doContent function in xmlparse.c

A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XMLResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags,...

Democritus Project d8s-lists Code Execution Vulnerability

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A backdoor vulnerability exists in Democritus Project d8s-lists version 0.1.0, which stems from the presence of a potential code execution package, democritus-dicts, inserte...

CVE-2022-42044

The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-html package. The affected version is 0.1.0...

CVE-2022-42038

The d8s-ip-addresses package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0...

PYSEC-2022-43045

The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-html package. The affected version is 0.1.0...

PYSEC-2022-43050

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

Code injection

The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...