Joy ebike Wolf 安全漏洞

Joy ebike Wolf is an electric scooter from Joy ebike India. Joy ebike Wolf Manufacturing 2022 has a security vulnerability that stems from vulnerability to Capture-replay bypassing authentication...

Demokratian 安全漏洞

Demokratian is a Demokratian open source web application for voting in a simple and secure way. A security vulnerability exists in Demokratian, which originates in the install/install3.php file and can lead to privilege escalation...

MAL-2022-2320 Malicious code in dai-pg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 380a8ec5aad17aa31577c83a6d88aa6060b4631380bc351d846ef8b6d9d0a1e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

KiteTech Keep My Notes 安全漏洞

KiteTech Keep My Notes is a simple, efficient and very easy to use notepad from KiteTech. A security vulnerability exists in KiteTech Keep My Notes version 1.80.147, which stems from a lack of sufficient security controls to prevent dynamic code manipulation. An attacker can exploit the...

Car Rental Management System SQL注入漏洞

Car Rental Management System is a car rental management system. SQL injection vulnerability exists in Car Rental Management System, which can be exploited by attackers to view, add, modify or delete information in the back-end database...

ABB e-Design 安全漏洞

ABB e-Design is a tool from ABB Switzerland for designing electrical systems using ABB hardware. A security vulnerability exists in ABB e-Design that stems from an incorrect default privileges vulnerability in ABB e-Design. An attacker could use this vulnerability to install malware that executes...

MAL-2022-5678 Malicious code in react-transition-group-community-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b1e2c2585378ef4d60748ca8cd6ecb367a96e8b0cf927c239e1bcc204b39768 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-666 Malicious code in @tr-digital/react-rehydrate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2599cb34105baaf5c4b9d139c06458eb3358bd0ab2b874bbcedb2e87e4176f51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Chris Brame Trudesk 安全漏洞

Chris Brame Trudesk is an open source helpdesk/ticketing solution from Chris Brame USA. A security vulnerability exists in versions prior to Chris Brame Trudesk 1.2.3, which stems from the presence of a synchronization error...

Anyone can cancel orders from the router and get the tokens

Lines of code Vulnerability details Impact Anyone can cancel orders from the router and get the tokens Proof of concept -A user makes a WETH order from the router -Any attacker can call the cancel function with the order ID and get all the unfilled funds from the order Basically orders in the...

Wargaming World of Warships 安全漏洞

Wargaming World of Warships is a 3D massively multiplayer online role-playing shooter with a naval warfare theme from the first half of the 20th century by Wargaming Cyprus. A security vulnerability exists in Wargaming World of Warships version 0.11.4, which stems from a problem with the playback...

Seamless Donations < 5.1.9 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack document.getElementById"test".submit; Some link: https://google.com input type="text" name="dgxdonateemailanon" value="You have requested th...

PT-2022-19178 · Abb · Abb E-Design

Name of the Vulnerable Software and Affected Versions: ABB e-Design affected versions not specified Description: The issue concerns a vulnerability in ABB e-Design that allows an attacker to install malicious software, executing with SYSTEM permissions. This compromises the confidentiality,...

Arista Networks Arista EOS 安全漏洞

Arista Networks Arista EOS is a scalable operating system for data centers and cloud network centers from Arista Networks, Inc. Arista EOS builds cloud architectures that scale to hundreds of thousands of compute and storage nodes with management and provisioning capabilities for large-scale jobs...

What’s wrong with automotive mobile apps?

Introduction The recent story about the 19-year-old hacker who took control of several dozen Tesla cars has become something of a sensation. We already know that there was an issue with a third-party app that enabled access to data from Teslas. This made it possible for the security researcher to...

Cross site scripting attack in ServiceStack Framework

ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting XSS. The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side...

Support bundles can include user session IDs in Jenkins Support Core Plugin

Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user basic authentication details only" information user.md. In some configurations, this can include the session ID of the user creating the support bundle. Attackers with access to support...

GHSA-656G-HF8V-X2RW Secret stored in plain text by Jenkins Slack Upload Plugin

Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system...

Chicago students lose data to ransomware attackers

Chicago Public Schools CPS disclosed on Friday that students may have had their data taken in a ransomware incident involving one of its vendors. The ransomware attack happened last December at Battelle for Kids BfK, based in Columbus Ohio, which develops services to provide innovation in schools...

MAL-2022-377 Malicious code in @kibt/operation-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0c471df352822441445b896723595fb8555214cc80aaa429baabfcf3bd2010e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...