EUVD-2022-7391

Malicious code in bioql PyPI...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to the electron module (CVE-2022-29247, CVE-2022-36077)

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to the electron module CVE-2022-29247, CVE-2022-36077. Electron is used for Discovery Connectors in IBM App Connect Enterprise. The latest fixpack includes electron v21.2.0 Vulnerability Details CVEID:CVE-2022-36077...

Improper Access Control

Electron is vulnerable to improper access control. The vulnerability is caused by Electron responding with NTLM authentication, including hashed credentials. This sensitive information leak occurs when the redirect target uses an SMB URL type starting withfile://, as the library delays the check...

CVE-2022-36077

The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecti...

Format string

Multiple format string vulnerabilities in Network Authorization in Apple Mac OS X 10.6 before 10.6.4 allow remote attackers to execute arbitrary code or cause a denial of service application crash via format string specifiers in a 1 afp, 2 cifs, or 3 smb URL...

CVE-2010-1376

Multiple format string vulnerabilities in Network Authorization in Apple Mac OS X 10.6 before 10.6.4 allow remote attackers to execute arbitrary code or cause a denial of service application crash via format string specifiers in a 1 afp, 2 cifs, or 3 smb URL...

USN-851-1: Elinks vulnerabilities

Teemu Salmela discovered that Elinks did not properly validate input when processing smb:// URLs. If a user were tricked into viewing a malicious website and had smbclient installed, a remote attacker could execute arbitrary code with the privileges of the user invoking the program. CVE-2006-5925...

ELinks URL串处理smbclient远程命令注入漏洞

ELinks是一款开放源码的WEB浏览器。 ELinks在处理SMB相关的URL串时存在命令注入漏洞，远程攻击者可能利用此漏洞在用户机器上执行任意命令。 ELinks没有正确验证“smb://”URL串就调用smbclient命令，允许攻击者在上述URL中注入smbclient命令下载和覆盖本地文件或向SMB共享上传文件。漏洞相关代码如下： ----------------------------------------------------------------------------- smbfunc in smb.c: ... 143 if share 144 if !dir ...