29 matches found
CVE-2022-48308
It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...
Path traversal
A Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files...
Malicious code in coldstone-sls (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72ac39360f255a45fb8e4b2e5d51651953e42f65c88e3db649b633eb728d5c27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
SaltStack Salt Information Gatherer
This module gathers information from SaltStack Salt masters and minions. Data gathered from minions: 1. salt minion config file Data gathered from masters: 1. minion list denied, pre, rejected, accepted 2. minion hostname/ip/os depending on module settings 3. SLS 4. roster, any SSH keys are...
slsarts.com Cross Site Scripting vulnerability OBB-1381871
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Malicious Package
Overview aliyun-sls is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using aliyun-sls...
CVE-2018-10383
CVE-2018-10383 affects Lantronix SecureLinx Spider (SLS) 2.2+ devices, with a cross-site scripting (XSS) flaw in the login page (auth.asp). The connected nuclei template confirms the vulnerability, describing that an attacker can inject/execute JavaScript in victims’ browsers, potentially leaking...
