QR code generator My QR Code leaks users’ login data and addresses

By Waqas My QR Code was informed about the leak almost two weeks ago, yet it failed to respond or secure its server. This is a post from HackRead.com Read the original post: QR code generator My QR Code leaks users login data and addresses...

CVE-2021-33237

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Consult IDs: CVE-2021-36686. Reason: This candidate is a duplicate of CVE-2021-36686. Notes: All CVE users should reference CVE-2021-36686 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Examples a lot of attributes are affected!,...

GSD-2023-1002220 bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation

bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.231 by commit...

GSD-2023-1002189 netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.

netfilter: ipset: Fix overflow before widen in the bitmapipcreate function. This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.164 by commit...

GSD-2023-1002146 cifs: Fix oops due to uncleared server->smbd_conn in reconnect

cifs: Fix oops due to uncleared server-smbdconn in reconnect This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.166 by commit...

GSD-2023-1002053 x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL

x86/i8259: Mark legacy PIC interrupts with IRQLEVEL This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.91 by commit...

GSD-2023-1001919 thermal: core: call put_device() only after device_register() fails

thermal: core: call putdevice only after deviceregister fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.1.9 by commit...

Remote Code Execution

lava is vulnerable to Remote Code Execution. The vulnerability exists in the REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template which allows an attacker to execute arbitrary codes...

MAL-2023-1647 Malicious code in beutifulsoup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f1dfa0882ee26c021dbe459f69acb1c31a8f6141b5df94313b6e806deb2027ee Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2178 Malicious code in requestts-toolbelt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a4daf428d7a1ca554f27713fe270eabb55b71597caedb7fe37bd3236965b5279 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2184 Malicious code in reuests-toolbelt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 100905361a4d05b301a6121d029f5fd00b33b0869f84341bf0b8bf7d414308cc Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2214 Malicious code in scikit-learnn (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 035554ad094b61a66ba40c4b40441e8af4e7cb3f862f7df3e25633af52cf3569 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2222 Malicious code in scikt-learn (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1e9bef88276a424a966a4c39baf6f4fa094eb263ed757a8082a71a36d4860b5e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2227 Malicious code in scray (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fbb35bf10c3af095dc9ea6ef91b21512b9453d7dcc84bb8d0d80d50f8ee3f044 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-1635 Malicious code in beautiifulsoup4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f1d72d2bcf09333bf15599a8da6727f5b3a66a8acabe720f81e3fd1532eb2a13 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-1692 Malicious code in coloraa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 457e6379b8bd37c651314a62416a57bea0f7bc6e21903473442219a67440628b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2462 Malicious code in yfniance (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1a8f0724e257a37153444c6747aeef306ff749d14643666aa8bdc8d0b7707d90 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Upgraded Q -> 3 from #510 [1675932827359]

Judge has assessed an item in Issue 510 as 3 risk. The relevant finding follows: In red are the state transitions that can only be performed with special privileges recreateMinipool: The following transitions will be performed Withdrawable-PreLaunch Error-PreLaunch createMinipool: will perform th...

GHSA-PWCW-6F5G-GXF8 Helm vulnerable to information disclosure via getHostByName Function

A Helm contributor discovered an information disclosure vulnerability using the getHostByName template function. Impact getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the...