Drupal core - Moderately critical - Information Disclosure - SA-CORE-2022-012

More info at https://www.drupal.org/sa-core-2022-012...

CVE-2022-36303

Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the handlefileupload function at /web/api/v1/upload/UploadHandler.php...

MAL-2022-288 Malicious code in @gettilled/tslint-preset (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5478810c7b484498848c6877efa1f0d201924cebc3e2cc8e439762e4c1b2a3fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SonicWall Switch Post-Authenticated Remote Code Execution

A vulnerability in SonicWall Switch 1.1.1.0-2s and earlier allows an authenticated malicious user to perform remote code execution in the host system. CVE: CVE-2022-2323 Last updated: July 15, 2022, 4:11 p.m...

Timing Attack

@fastify/bearer-auth is vulnerable to timing attacks. The vulnerability exists because the timingSafeEqual functionality in the compare function of plugin.js does not securely perform a constant-time comparison against the length of the bearer token, allowing an attacker to guess the length of th...

CVE-2022-25802

Best Practical Request Tracker RT before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an attachment...

SQL Injection

in2code/lux is vulnerable to SQL injection attacks. A specifically crafted attack statement through the fingerprint parameter in getFingerprintCountByValue function allows a malicious user to inject and execute arbitrary SQL queries on the target system...

Denial Of Service (DoS)

libguestfs.so is vulnerable to Denial Of Service DoS.The vulnerability exists because it causes a buffer overflow in getkeys while calculating the greatest possible number of matching keys in the function...

OSV-2022-578 Heap-buffer-overflow in mrb_bint_to_s

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49045 Crash type: Heap-buffer-overflow WRITE 1 Crash state: mrbbinttos inttos mrbvmexec...

Incorrect Authorization

All unpatched versions of Argo CD starting with v1.0.0 is vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level...

MAL-2022-7394 Malicious code in zjdkvqcxmknipaye (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d91bb2e968fe7009c7db69c83e44f8b3f0a528992e3be20cb30a64f770b04405 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-22171 · Siemens · Parasolid +1

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V33.1.264 Parasolid versions prior to V34.0.250 Parasolid versions prior to V34.1.233 Simcenter Femap versions prior to V2022.1.3 Simcenter Femap versions prior to V2022.2.2 Description: The issue arises from an ou...

MAL-2022-5355 Malicious code in pkvqlrgfbyxehwka (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ac13088cf851e0843b4772d86df4353bd57188f4c1f525357450efdf4fa5cb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1959 Malicious code in cnqihwetjuapsgkb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51fc3c4a11a650d7b847eb943e6c3b4cc3914a07f5c5ab7be0f083a693c4b77c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4220 Malicious code in kpqrynfjhmukowct (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 832bb1600b343fdb7daca7a70bbfc5972b67c248ee8fd0aa2f8ca6ffd23fc221 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4579 Malicious code in mflxtioqpeahbkzk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 538288efbc33c56624c40f86312ca7f5c45fd3c2770eac666f58877fbda1f0ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VMSA-2022-0018:VMware vCenter Server updates address a server-side request forgery vulnerability

Advisory ID: VMSA-2022-0018 CVSSv3 Range: 5.3 Issue Date:2022-07-12 Updated On: 2022-07-23 CVEs: CVE-2022-22982 Synopsis: VMware vCenter Server updates address a server-side request forgery vulnerability CVE-2022-22982 RSS Feed Download PDF Download Text File Share this page on social media: 1...

"Failed to import signatures" - Veeam Intelligent Diagnostic Signatures Update Failure

Challenge Attempting to update Veeam Intelligent Diagnostics signatures fails, and a pop-up appears with the message: Failed to import signatures Cause This issue occurs due to recent certificate changes that affected the Veeam Intelligent Diagnostics signature update process. Solution Option 1:...

CVE-2021-43116

An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login...

MAL-2022-4890 Malicious code in node-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e48deb4e94109fe1c6aa6462bcd840fba34d7a47198045030885d6e0f85931a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...