Oracle Access Manager Remote Code Execution

A vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: OpenSSO Agent, allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager...

Google Web Toolkit Detected

This is an informational notice that the scanner was able to detect an application using Google Web Toolkit. No source data...

MAL-2022-3286 Malicious code in gatsby-source-data-dictionary (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 609b9ce0046338f15cd270efb8914e5b4c3697afc1ac16fe9e0ac9d5ab9b2624 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-3253

Name of the Vulnerable Software and Affected Versions Dominion Voting Systems ImageCast X affected versions not specified Description The authentication mechanism used by voters to activate a voting session is susceptible to forgery. An attacker could leverage this issue to print an arbitrary...

Apache Struts 2.x < 2.5.29 Remote Code Execution (S2-062)

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag's attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. Using forced OGNL evaluation on untrusted user input can lead to a...

Python Object Deserialization

Serialization is the process of converting an object to a stream of bytes, in order to store or send it through the network. By opposition, deserialization is the process of reconstructing an object from this stream of bytes. When Python web applications use the pickle library to perform...

Wget Listing File Detected

The web server on the remote host contains publicly accessible Wget listing files. These listing files are produced by Wget during ftp transfers and contain details of source/destination file names, permissions, date of upload and other potentially sensitive information. This may be used to acces...

CVE-2022-1586

creationtimestamp| type| source ---|---|--- 2022-05-17 00:26:40+00:00| seen| https://t.me/cibsecurity/42781 2022-08-31 19:00:04+00:00| seen| https://t.me/poxek/2416 2025-02-11 21:12:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/3914 2025-02-14 10:04:00+00:00| seen|...

SQL File Detected

SQL files have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks. No source data...

Jira Service Desk Sign Up Detected

Atlassian Jira is a software application used for issue tracking and project management. An internal only Atlassian Jira Service Desk instance may be misconfigured to be accessible to 3rd parties to sign up, potentially leading to attackers creating accounts and raising ticket requests for...

Spring Boot Actuator Detected

This is an informational notice that the scanner was able to detect an accessible Spring Actuator. Actuator endpoints let you monitor and interact with your application. Spring Boot includes a number of built-in endpoints and lets you add your own. For example, the 'health' endpoint provides basi...

Docker Compose Configuration Detected

Docker Compose is a tool designed to help developers defining and running multi-container Docker applications. By defining a configuration file named docker-compose.yml in their application project directory, developers can define the different services used by the application with their...

Google Cloud Build Configuration Detected

Cloud Build is Google Cloud continuous integration and deployment serverless platform used to build and test software projects. By defining a configuration file named cloudbuild.yaml in their source code repositories, developers can customize their applications build workflows. When exposed with...

Jenkins Stapler < 2.138.4 LTS / 2.154 Remote Code Execution

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not...

Travis CI Configuration Detected

Travis CI is a Software as a Service SaaS based continuous integration service used to build and test software projects. By defining a configuration file named .travis.yml in their source code repositories, developers can customize their applications build workflows. When exposed with the web...

UpdraftPlus Backup Plugin for WordPress 1.16.7 < 1.22.3 Backup Download

The WordPress UpdraftPlus Backup Plugin installed on the remote host is affected by an authenticated backup download vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

PHP 8.1.x < 8.1.3 Use After Free Vulnerability

According to its self-reported version number, the version of PHP running on the remote web server is 7.4.x prior to 7.4.28, 8.0.x prior to 8.0.16 or 8.1.x prior to 8.1.3. It is, therefore, affected by a use after free vulnerability due to phpfilterfloat failing for ints. Note that the scanner ha...

GitLab CI Configuration Detected

GitLab is a popular Git-based Source Code Management system SCM provided by GitLab Inc. as both a cloud and an on-premise service. GitLab has Continuous Integration and Continuous Development CI/CD capabilities offering automatic builds, tests and deployments through a configuration file named...

Jenkinsfile Detected

Jenkins is a popular open source automation software used to help building, testing and deploying software. Jenkins Pipeline is a collection of plugins allowing developers to implement and integrate continuous delivery CD into Jenkins, by defining a Jenkinsfile file and adding it to their source...

CircleCI Configuration Detected

CircleCI is a continuous integration service available as a Software as a Service SaaS based application or as a private instance and which is used to build and test software projects. By defining a configuration file named .circleci/config.yml in their source code repositories, developers can...