CVE-2022-1844 WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF

The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well...

WordPress plugin WP Sentry 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Sentry plugin version 1.0 and earlier versions are vulnerable to cross-site request...

Malicious Package

Overview @kraken-frontend/sentry is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview oms-sentry is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious code in gd-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f09966e5144fef4a5b06276ab8331c6a5849c1bcc705af36dd3914dcb78b5d51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3316 Malicious code in gd-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f09966e5144fef4a5b06276ab8331c6a5849c1bcc705af36dd3914dcb78b5d51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in oms-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fc10a735991e54e1553bcd8bc1c4041ec2456c5e47cc64291bd5ea3931e5c2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5070 Malicious code in oms-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fc10a735991e54e1553bcd8bc1c4041ec2456c5e47cc64291bd5ea3931e5c2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well PoC...

WP Sentry <= 1.0 - Arbitrary Settings Update to Stored XSS via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well ' " document.getElementById"test".submit; "...

NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications

A Developer and Security Engineer friendly package for Securing NodeJS Applications. Inspired by the log4J vulnerability CVE-2021-44228 which can be exploited because an application can make arbitrary network calls. We felt there is an need for an application to declare what privileges it can hav...

Apache Sentry may allow attacker to access/remove data from Sentry protected table

An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table...

GHSA-6XHJ-P29V-82J8 Apache Sentry may allow attacker to access/remove data from Sentry protected table

An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table...

The vulnerability of the Git-based software platform for collaborative code development on GitLab lies in the ability to create and track user-defined tasks for Sentry errors. This allows a violator to access confidential data and compromise its integrity.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the ability for users to create and track issues for Sentry errors. Exploiting this vulnerability allows a malicious actor to gain access to confidential data and compromise its integri...

Cloudflare Public Bug Bounty: Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfiguration

Cloudflare uses Sentry for application monitoring and error tracking. Due to the tool's misconfiguration source code scraping feature enabled, it was possible to sent blind requests to any endpoints using the Cloudflare infrastructure. The issue has been fixed by the Engineering team and the sour...

Ivanti Updates Log4j Advisory with Security Updates for Multiple Products  

Ivanti has updated its Log4j Advisory with security updates for multiple products to address CVE-2021-44228. An unauthenticated attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review the Ivanti security advisories pages...

@backstage/plugin-scaffolder-backend-module-confluence-to-markdown (>=0.0.0-nightly-20230325022054 <=0.0.0-nightly-20230801022410), @backstage/plugin-scaffolder-backend-module-cookiecutter (>=0.0.0-nightly-2022122206 <=0.1.0) +3 more potentially affected by unknown CVE via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041 <=0.14.2)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2022122206, =0.0.0-nightly-2022122206, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2022122206, =0.0.0-nightly-20230123022600 Source cves: unknown CVE Source advisory:...

@backstage/plugin-scaffolder-backend-module-confluence-to-markdown (>=0.0.0-nightly-20230325022054 <=0.0.0-nightly-20230801022410), @backstage/plugin-scaffolder-backend-module-cookiecutter (>=0.0.0-nightly-2022122206 <=0.1.0) +3 more potentially affected by CVE-2021-43783 via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041 <=0.14.2)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2022122206, =0.0.0-nightly-2022122206, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2022122206, =0.0.0-nightly-20230123022600 Source cves: CVE-2021-43783 Source advisory:...

The vulnerabilities include those of the MobileIron Core, a secure mobile gateway for managing the lifecycle of mobile devices and applications; the MobileIron Sentry, an application for data monitoring; the MobileIron Monitor and Reporting Database (RDB), an application for collecting data about devices and software; and the MobileIron Enterprise Connector, which is related to access control deficiencies, allowing attackers to execute arbitrary code.

The vulnerabilities of the MobileIron Core, a secure mobile gateway; the MobileIron Sentry, a data monitoring application; the MobileIron Monitor and Reporting Database RDB, which collects data about devices and software; and the MobileIron Enterprise Connector are related to deficiencies in acce...

Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability

Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database RDB products contain an unspecified vulnerability that allows for remote code execution...