Malicious code in react-redux-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c925fbb7f1f8ff0a18bffa326943d62e0558498dfa914b896e91387fa6534fa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in woofi_swap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92071fc9d8415ccf1567d9edc7f3b56a2ff6493a8a80f07bd786d5db363addce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth-balance-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5262abe8a739e9f893b3a0f9ce010d19304358cb843873f597ff90d79d619ccb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arm-timeseriesinsights (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37f7e8c901f6fc9cf630db92bc3c68c7797fac453ccc86d9c907101bd8b0f5d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in automate-loadtest-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a3e035cd51e6ec41e8ea3f505a60f66710126e8675b5a5f84e89273aa1cfe95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5580 Malicious code in rancher-website-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 030aba0fda5958570307e15fc0aa75c5ea4c7517ad03f30dd76176340fc33028 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @kaspersky/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 353c3be162a0520ec9a4097a45b0b3df2fc85b4ac6993fc40cca5a13708e3e4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @logistics-frontend/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 917015e67d3524947bf6202269dd9d3b5ce19a12c03609c67b0c04073720abdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-3532

Name of the Vulnerable Software and Affected Versions Linux kernel versions affected versions not specified Description The issue is related to a buffer overflow in the nftable filtering and classification subsystem of the Linux kernel. Exploitation of this issue may allow an attacker to elevate...

Scrapy denial of service vulnerability

Scrapy 1.4 allows remote attackers to cause a denial of service memory consumption via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by...

CVE-2021-43931

The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error...

CVE-2021-43931

The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error...

cxf: XSS via the styleSheetPath

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...

Cooked < 1.7.9.1- Unauthenticated Reflected Cross-Site Scripting (XSS)

The plugin was vulnerable to Unauthenticated Reflected Cross-Site Scripting XSS. For clarification, this vulnerability is separate to the similar vulnerability CVE-2021-24233. PoC The PoC will be displayed once the issue has been remediated...

Race condition

A race condition with requestPointerLock and setTimeout could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements such as input type="file" this could have led to an attack where a user was confused about the origin...

Signal Adds Cryptocurrency Support

According to Wired, Signal is adding support for the cryptocurrency MobileCoin, "a form of digital cash designed to work efficiently on mobile devices while protecting users privacy and even their anonymity." Moxie Marlinspike, the creator of Signal and CEO of the nonprofit that runs it, describe...

5 steps to enable your corporate SOC to rapidly detect and respond to IoT/OT threats

As organizations connect massive numbers of IoT/OT devices to their networks to optimize operations, boards and management teams are increasingly concerned about the expanding attack surface and corporate liability that they represent. These connected devices can be compromised by adversaries to...

PT-2021-14393 · Unknown · Oauth2 Proxy

Name of the Vulnerable Software and Affected Versions: OAuth2 Proxy versions prior to 7.0.0 Description: The issue concerns the whitelist domain feature in OAuth2 Proxy, where a domain that ends similarly to the intended domain could be allowed as a redirect. For example, if a whitelist domain is...

CVE-2020-13954 Apache CXF Reflected XSS in the services listing page via the styleSheetPath

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...

openSUSE Security Update : binutils (openSUSE-2020-1790)

This update for binutils fixes the following issues : binutils was updated to version 2.35. jscECO-2373 Update to binutils 2.35 : - The assembler can now produce DWARF-5 format line number tables. - Readelf now has a 'lint' mode to enable extra checks of the files it is processing. - Readelf will...