138 matches found
CVE-2022-39072: Improper Neutralization of Special Elements used in an SQL Command
There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks...
openssl: c_rehash script allows command injection
A flaw was found in OpenSSL. The crehash script does not properly sanitize shell meta-characters to prevent command injection. Some operating systems distribute this script in a manner where it is automatically executed. This flaw allows an attacker to execute arbitrary commands with the privileg...
CVE-2022-39217
some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...
CVE-2022-39217: Improper Neutralization of Special Elements in Output Used by a Downstream Component
some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...
PT-2022-24816
Name of the Vulnerable Software and Affected Versions some-natalie/ghas-to-csv versions prior to v1 Description The issue arises from the GitHub Action creating a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code or...
Malicious Package
Overview some-dependency is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...
Malicious Package
Overview some-plugin is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Malicious Package
Overview some-buidler-plugin is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...
Malicious code in some-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8156422985121c50c8388169e03a62b1ace6399e2fb83cee3860fa03e57d3e1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in some-buidler-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4364b95f692a6e68b922ca085cbc8a044375bad015acc427396adf15e6705f99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6209 Malicious code in some-buidler-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4364b95f692a6e68b922ca085cbc8a044375bad015acc427396adf15e6705f99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
alexisprost.fr Cross Site Scripting vulnerability OBB-2837222
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2020-14123: Double Free
There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affectin...
GSD-2022-1000481 pidfd: fix test failure due to stack overflow on some arches
pidfd: fix test failure due to stack overflow on some arches This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.25 by commit...
Python < 2.7.14, 3.4.x < 3.4.8, 3.5.x < 3.5.5 PyString_DecodeEscape integer overflow (bpo-30657) - Linux
CPython aka Python is prone to an integer overflow vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...
Huawei HarmonyOS security vulnerabilities
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS Some Huawei products have security vulnerabilities...
IBM Spectrum Scale injection vulnerability
IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...
CVE-2020-8036
An out-of-bounds read vulnerability was discovered in tcpdump while printing SOME/IP packets captured in a pcap file or coming from the network. This flaw allows a remote attacker to send specially crafted packets that, when printed, can trigger the flaw and crash the application. The highest...
