15-Year-Old Unpatched Python Vulnerability Potentially Affects Over 350,000 Projects

As many as 350,000 open source projects are believed to be potentially vulnerable to exploitation as a result of a security flaw in a Python module that has remained unpatched for 15 years. The open source repositories span a number of industry verticals, such as software development, artificial...

arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm

Impact Arbitrary shell execution is possible when using RPM::Filefiles and RPM::Fileextract if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the extract and files methods of the RPM::File class in the affected versions of this library. Patches Version 0.0.12 ...

Harbor fails to validate the user permissions when viewing Webhook policies

Impact Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have access to, resulting in malicious users being able to read Webhook policies of other users/projects. API call is GET...

GHSA-JF8P-3VJH-PQ94 Harbor fails to validate the user permissions when viewing Webhook policies

Impact Harbor fails to validate the user permissions to view Webhook policies including relevant credentials configured in different projects the user doesn’t have access to, resulting in malicious users being able to read Webhook policies of other users/projects. API call is GET...

org.testifyproject.client:jersey-client (>=0.9.3 <=1.0.1), org.testifyproject.container:docker (=0.9.3) +43 more potentially affected by CVE-2022-38749 via org.testifyproject.external:external-snakeyaml (>=0.9.5 <=1.0.0)

org.testifyproject.external:external-snakeyaml MAVEN version =0.9.5, =0.9.3, =0.9.3, =0.9.3, =1.0.0, =0.9.3, =0.9.2, =1.0.0, =0.9.3, =0.9.3, =1.0.0, =0.9.3, =0.9.3, =0.9.3, =0.9.3, =1.0.1 and more Source cves: CVE-2022-38749 Source advisory: OSV:GHSA-C4R9-R8FH-9VJ2...

September 6, 2022, update for Office 2016 (KB5002251)

None None...

Scammers Made Deepfake AI Hologram of Binance Executive

By Deeba Ahmed According to Patrick Hillmann, chief communications officer of Binance, his Deepfake AI hologram is being used by scammers to trick users into online meetings and target Binance clients' crypto projects. This is a post from HackRead.com Read the original post: Scammers Made Deepfak...

CVE-2022-31247

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings such as cluster-owner, manage cluster members, project-owner and manage project members to gain owner permission in another...

Improper access control

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea there was no permission check for fetching the issue. As a result, the attacker would get access to private issue title...

environmentalprojects.com.au Cross Site Scripting vulnerability OBB-2831267

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

buxtonprojects.com.au Cross Site Scripting vulnerability OBB-2828192

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-2095

An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint a...

CVE-2022-2326

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an...

CVE-2022-2326

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an...

UBUNTU-CVE-2022-2095

An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint a...

CVE-2022-2326

An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible to gain access to a private project through an email invite by using other user's email address as an...

CVE-2022-2326

Removed by vendor...

PT-2022-14855 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.7 through 15.0.4 GitLab CE/EE versions 15.1 through 15.1.3 GitLab CE/EE versions 15.2 through 15.2.0 Description: The issue is related to an improper access control check, allowing a malicious authenticated user to vi...

DSpace 信息泄露漏洞

DSpace is an open source turnkey repository application from the DuraSpace community. An information disclosure vulnerability exists in DSpace versions prior to 6.4, which stems from the fact that metadata for revoked projects in dspace-xmlui is exposed to the XMLUImets.xml object...

Fedora: Security Advisory for golang-github-google-slothfs (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...