CVE-2022-41933 Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the reset a forgotten password feature of XWiki was used, the password was then stored in plain text in database. This only concerns XWiki 13.1RC1 and newer versions. Note that it only...

Prototype Pollution

feathers-sequelize is vulnerable to prototype pollution. The vulnerability exists in the cleanQuery method due to the use of insecure recursive logic to filter unsupported keys from the query object, which allows an attacker to inject malicious properties resulting in prototype pollution...

IBM CICS TX Information Disclosure Vulnerability (CNVD-2022-83578)

IBM CICS TX is a comprehensive, single transaction runtime package from International Business Machines IBM. IBM CICS TX version 11.1 is vulnerable to an information disclosure vulnerability that stems from not setting security properties on authorization tokens or session cookies. An attacker...

ontarioresidentialproperties.com Cross Site Scripting vulnerability OBB-3057360

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SUSE SLES15: libpython3_6m1_0 / python3 / python3-base / python3-curses / etc (SUSE-SU-2022:3924-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3924-1 advisory. - CVE-2022-37454: Fixed a buffer overflow in hashlib.sha3 implementations. bsc1204577 - CVE-2020-10735: Fixed a bug to limit amount...

nodejs:14 security update

An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...

RHEL 8 : nodejs:14 (RHSA-2022:7830)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7830 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Prototype Pollution

deep-object-diff is vulnerable to prototype pollution. The library improperly validates the incoming JSON keys, which allows a remote attacker to edit or add new properties to an object through proto attribute...

Prototype Pollution

deep-parse-json is vulnerable to prototype pollution. The library improperly validates the incoming JSON keys, which allows a remote attacker to add new properties to an object through proto attribute...

CVE-2022-37454

A flaw was found in the Keccak XKCP SHA-3 reference implementation. The sponge function interface allows partial input data to be processed, and partial output to be produced. When at least one of these has a length of 4294967096 bytes or more, it can result in elimination of cryptographic...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound which allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. Remediation Upgrade sha3 to version 1.0.5 or higher. Reference...

Prototype Pollution

unset-value is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the module.exports function in index.js and modify attributes such as proto, constructor, and prototype base objects...

Code injection

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the 'proto' property to be edited...

Design/Logic Flaw

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...

CLSA-2022-1667495676 java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u352-b08. That fixes following CVEs: - CVE-2022-21619: Improper handling of long NTLM client hostnames - CVE-2022-21624: Insufficient randomization of JNDI DNS port numbers - CVE-2022-21626: Excessive memory allocation in X.509 certificate...

CLSA-2022-1667494847 java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u352-b08. That fixes following CVEs: - CVE-2022-21619: Improper handling of long NTLM client hostnames - CVE-2022-21624: Insufficient randomization of JNDI DNS port numbers - CVE-2022-21626: Excessive memory allocation in X.509 certificate...

CVE-2022-41713 deep-object-diff 1.1.0 - Prototype Pollution

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the 'proto' property to be edited...

CVE-2022-42743 deep-parse-json 1.0.2 - Prototype Pollution

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...

CVE-2022-41714 fastest-json-copy 1.0.1 - Prototype Pollution

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...

CVE-2022-41714 fastest-json-copy 1.0.1 - Prototype Pollution

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the 'proto' property to be edited...