Malicious code in omar-evil-test-rpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e5e94c35a9358e80839da1d1e54bf442ee12222b449aba7928ce4e04e801056 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @specials/match-media (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e0f5386f94497eb0315d2358c99de8c51a9f6b76e96ba9d77f5dccc7f41949a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in browser-wurfl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e4c2fbc661ad78d8cf71c3cde8ba31549ab0506e14c420f979915c639387d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-845 Malicious code in adaptivecards-designer-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 856c233e2f24035efd8d882b600a5c0242af1ed5eea2fda4eca7f5cad6d01e6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sportsbook-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 406d6055f3ec798d94c6267c0cd303138551c345c9b059490e045de4768579be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cooley/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e7a79bf065ea338d9aad1f17927b89d85d6c6670396eb353f79a3008c107c54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

YearnCurveVaultOperator's depositETH can leave the remainder ETH funds frozen and unaccounted for, then utilized by another caller

Lines of code Vulnerability details depositETH effectively do not control the utilization of input token and can freeze WETH input funds in native ETH form on the contract balance when Yearn pool doesn't perform liquidity addition for any reason. Due to presence of the additional WETH - ETH step,...

Security Bulletin: Potential module resolution error in DataPower Operator

Summary IBM has addressed a potential build-time issue. This did not affect product code, but may have been detected in customer scans. Vulnerability Details CVEID:CVE-2022-23773 DESCRIPTION: An unspecified error with not treating branches with semantic-version names as releases in cmd/go in Gola...

EulerOS 2.0 SP5 : rsyslog (EulerOS-SA-2022-1914)

According to the versions of the rsyslog packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted...

Design/Logic Flaw

In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the...

CVE-2022-32155 Universal Forwarder management services allows remote login by default

In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the...

Synaptics Fingerprint SGX-enabled Driver June 2022 Security Update

Synaptics has informed HP of a potential security vulnerability identified in Synaptics® Fingerprint drivers that use SGX which may allow denial of service and information disclosure. Synaptics has released mitigation for this potential vulnerability. Synaptics has released updates to mitigate th...

Debian: Security Advisory (DLA-3045-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AlmaLinux 8 : rsyslog (ALSA-2022:4799)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:4799 advisory. - Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. Th...

Updated firefox/nss/nspr packages fix security vulnerability

A malicious website could have learned the size of a cross-origin resource that supported Range requests CVE-2022-31736. A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash CVE-2022-31737. When exiting fullscreen...

FreeBSD : zeek -- potential DoS vulnerabilty (204f1a7a-43df-412f-ad25-7dbe88f54fa4)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 204f1a7a-43df-412f-ad25-7dbe88f54fa4 advisory. - Tim Wojtulewicz of Corelight reports: Fix potential hang in the DNS analyzer when receiving a...

Bad use of safeApprove

Lines of code Vulnerability details Impact Function deposit in booster could revert when stake option is true if the contract has an allowance of the token for rewarcontract 0. The same in many contracts but in VE3DRewardPool.sol a user can get his rewards blocked. Proof of Concept If the contrac...

Mozilla: Heap buffer overflow in WebGL

The Mozilla Foundation Security Advisory describes this flaw as: A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash...

Mozilla: Heap buffer overflow in WebGL

The Mozilla Foundation Security Advisory describes this flaw as: A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash...

CVE-2021-34083

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...