CVE-2024-50336 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

Zoom Client Security Vulnerability

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A security vulnerability exists in Zoom Client versions prior to 5.16.10 that stems from improper access control, resulting in an elevation of privilege vulnerability. Affected products and...

Researchers Discover Malicious PyPI Package Posing as SentinelOne SDK to Steal Data

Cybersecurity researchers have discovered a new malicious package on the Python Package Index PyPI repository that impersonates a software development kit SDK for SentinelOne, a major cybersecurity company, as part of a campaign dubbed SentinelSneak. The package, named SentinelOne and now taken...

CVE-2022-30187

creationtimestamp| type| source ---|---|--- 2022-07-13 02:25:48+00:00| seen| https://t.me/cibsecurity/46123 2022-07-18 05:00:00+00:00| seen| https://msrc.microsoft.com/blog/2022/07/mitigation-for-azure-storage-sdk-client-side-encryption-padding-oracle-vulnerability/...

Malicious code in sdk-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f54c1d86b5b606384bb94d0e6720103aa0542360a6843c8220b24370cad88c1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5976 Malicious code in sdk-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f54c1d86b5b606384bb94d0e6720103aa0542360a6843c8220b24370cad88c1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2016-3532

Unspecified vulnerability in the Oracle Advanced Inbound Telephony component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to SDK client integration. NOTE: the previous information is from the July 2016 CP...