esm.sh CDN service has arbitrary file write via tarslip

Summary The esm.sh CDN service is vulnerable to a Path Traversal CWE-22 vulnerability during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths e.g., package/../../tmp/evil.js. When esm.sh downloads and extracts this package, file...

EUVD-2023-47239

Malicious code in bioql PyPI...

EUVD-2023-47238

Malicious code in bioql PyPI...

CVE-2023-42816

Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch...

Purpose of CMSTART command

This article provides information about the command CMSTART. Purpose of CMSTART command Cmstart.exe is a process that runs when you log on to the XenApp server. It is called by winlogon. It is associated with Wfshell.exe, CltMgr.exe, and Icast.exe files. The cmstart is controlled by the following...

Cosign Resource Management Error Vulnerability

cosign is a container signing, verification and storage in an OCI registry in the United States. A resource management error vulnerability exists in Cosign 2.2.0 and prior versions, which stems from a vulnerability that allows an attacker to take control of the registry and cause a denial of...

Pywirt - Python Windows Incident Response Toolkit

With this application, it is aimed to accelerate the incident response processes by collecting information in windows operating systems via winrm. Features Information is collected in the following contents. IP Configuration Users Groups Tasks Services Task Scheduler Registry Control Active TCP &...

Seagate Media Sync Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Seagate Media Sync, a file synchronization tool, due to a failure in the Seagate Media Sync software to properly handle the transfer of data between its two processes via the named pipe MEDIAAGGREPIPE.PIP and the ability to create registry values...