MAL-2022-7138 Malicious code in whistle-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a0c9dd0fea7a98b0162f806f87792c62435fd62609fff1b5d05a70e2cc0a777 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Admin-Panel_Finder - A Burp Suite Extension That Enumerates Infrastructure And Application Admin Interfaces (OTG-CONFIG-005)

A burp suite extension that enumerates infrastructure and application Admin Interfaces. OWASP References: Classification : Web Application Security Testing 02-Configuration and Deployment Management Testing OTG v4 : OWASP OTG-CONFIG-005 WSTG : WSTG-CONF-05 Why should I use this extension?...

CVE-2022-20145

In startLegacyVpnPrivileged of Vpn.java, there is a possible way to retrieve VPN credentials due to a protocol downgrade attack. This could lead to remote escalation of privilege if a malicious Wi-Fi AP is used, with no additional execution privileges needed. User interaction is not needed for...

CLSA-2022-1654804240 Fixed CVEs in vim: CVE-2022-1851, CVE-2022-1898, CVE-2022-1886, CVE-2022-0319

CVE-2022-0319: correct end of Visual area when entering another buffer - CVE-2022-1851: fix invalid cursor position after text formatting - CVE-2022-1886: fix access before start of text with a put command - CVE-2022-1898: fix using freed memory with 'd'...

Ubuntu 16.04 ESM : Vim vulnerabilities (USN-5458-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5458-1 advisory. It was discovered that Vim was incorrectly handling virtual column position operations, which could result in an out-of-bounds read. An attacker could...

PersistBOF - Tool To Help Automate Common Persistence Mechanisms

A tool to help automate common persistence mechanisms. Currently supports Print Monitor SYSTEM, Time Provider Network Service, Start folder shortcut hijacking User, and Junction Folder User Usage Clone, run make, add .cna to Cobalt Strike client. run: help persist-ice in CS console Syntax:...

AZL-43666 CVE-2022-31650 affecting package sox 14.4.2.0-34

In SoX 14.4.2, there is a floating-point exception in lsxaiffstartwrite in aiff.c in libsox.a...

CLSA-2022-1653506138 Fixed CVE-2021-33515 in dovecot

CVE-2021-33515: fix possible command injection by stopping reading commands when input was locked by the STARTTLS command...

CLSA-2022-1653329020 Fix CVE(s): CVE-2022-1629, CVE-2022-1616, CVE-2022-1620, CVE-2022-1621, CVE-2022-1619

SECURITY UPDATE: Going before the start of the command line - debian/patches/CVE-2022-1619.patch: Check already being at the start of the command line - CVE-2022-1619 SECURITY UPDATE: NULL pointer access when using invalid pattern - debian/patches/CVE-2022-1620.patch: Check for failed regexp...

OESA-2022-1666 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: usb8devstartxmit in drivers/net/can/usb/usb8dev.c in the Linux kernel through 5.17.1 has a double free.CVE-2022-28388 mcbausbstartxmit in drivers/net/can/usb/mcbausb.c in the Linux kernel through 5.17.1 has a double...

CVE-2022-29641

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2022-29641

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences for example, from start tag names to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor...

bluez security update

An update is available for bluez. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The bluez packages contain the following utilities for use in Bluetooth...

Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2022-1669)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.9.0 : vim (EulerOS-SA-2022-1641)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - vim is vulnerable to Out-of-bounds Read CVE-2021-4166, CVE-2021-4193 - vim is vulnerable to Use After Free CVE-2021-4192 - vim is...

ASB-A-211481342

In startActivityForAttachedApplicationIfNeeded of RootWindowContainer.java, there is a possible way to overlay an app that believes it's still in the foreground, when it is not, due to a race condition. This could lead to local escalation of privilege with no additional execution privileges neede...

IBM Java 6.0 < 6.0.16.65 / 6.1 < 6.1.8.65 / 7.0 < 7.0.10.25 / 7.1 < 7.1.4.25 / 8.0 < 8.0.5.15 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.65 / 6.1 6.1.8.65 / 7.0 7.0.10.25 / 7.1 7.1.4.25 / 8.0 8.0.5.15. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle April 17 2018 CPU advisory. - Vulnerability in the Java SE, Java SE...

OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

The vulnerability of the ems_usb_start_xmit function in Linux kernel allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the emsusbstartxmit function in the Linux kernel’s drivers/net/can/usb/emsusb.c file is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information from a...