MAL-2022-6388 Malicious code in sync-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36a88f33209b094f3105a202873bb5e94e4f0053c82ea88e32b3cd1d3f7bea28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sync-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36a88f33209b094f3105a202873bb5e94e4f0053c82ea88e32b3cd1d3f7bea28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ASB-A-209438553

In finishLsImpl of filesyncclient.cpp, there is a possible way to access host's files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2022-1359 · Unknown · File Sync Client

Name of the Vulnerable Software and Affected Versions: file sync client affected versions not specified Description: The issue is related to a path traversal error in the finishLsImpl function of file sync client.cpp. This error could allow access to the host's files, potentially leading to local...

Router: Transferring Token to the Pair contract will cause future liquidity providers to lose funds

Lines of code Vulnerability details Impact Same as code-423n4/2022-01-elasticswap-findings146 In the current implementation, the amount of LP tokens to be minted when addLiquidity is calculated based on the ratio between the amount of newly added tokens and the reserve variable in the Pair...

ai.tock:bot-test (20.9.3), ai.tock:bot-test-base (20.9.3) +64 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (4.2.0)

org.mongodb:mongodb-driver-sync MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.mongodb:mongodb-driver-sync and may be impacted: - ai.tock:bot-test 20.9.3 - ai.tock:bot-test-base 20.9.3 - ai.tock:bot-toolkit 20.9.3 -...

ai.tock:bot-test (20.9.3), ai.tock:bot-test-base (20.9.3) +64 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (4.2.0)

org.mongodb:mongodb-driver-sync MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.mongodb:mongodb-driver-sync and may be impacted: - ai.tock:bot-test 20.9.3 - ai.tock:bot-test-base 20.9.3 - ai.tock:bot-toolkit 20.9.3 -...

com.coditory.sherlock:sherlock-mongo-sync (0.4.3), com.hazelcast.jet.contrib:mongodb (0.2) +22 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.11.0, <=3.11.2)

org.mongodb:mongodb-driver-sync MAVEN version =3.11.0, =0.0.1, =2.1.18, =2.1.18, =2.1.18, =2.0.0, =2.0.0, =2.0.0, =5.0.20.rc, =1.6.1, =3.11.0, =3.11.2 - org.mongojack:mongojack 2.10.1 and more Source cves: CVE-2021-20328 Source advisory: GHSA-RGHW-6PX2-FGWC...

com.coditory.sherlock:sherlock-mongo-sync (0.4.3), com.hazelcast.jet.contrib:mongodb (0.2) +22 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.11.0, <=3.11.2)

org.mongodb:mongodb-driver-sync MAVEN version =3.11.0, =0.0.1, =2.1.18, =2.1.18, =2.1.18, =2.0.0, =2.0.0, =2.0.0, =5.0.20.rc, =1.6.1, =3.11.0, =3.11.2 - org.mongojack:mongojack 2.10.1 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0, <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0, <=4.5.0) +40 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.12.0, <=3.12.7)

org.mongodb:mongodb-driver-sync MAVEN version =3.12.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1, =3.0.0-alpha-15, =3.0.0-alpha-15, =4.5.0, =5.2.1, =5.2.1, =0.9.0, =0.10.0 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

ai.platon.commons:distributed-lock-example (>=1.4.2, <=1.4.3), ai.platon.commons:distributed-lock-mongo (>=1.4.2, <=1.4.3) +280 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=4.1.0, <=4.1.1)

org.mongodb:mongodb-driver-sync MAVEN version =4.1.0, =1.4.2, =1.4.2, =1.6.6, =1.6.6, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.9.2-1 and more Source cves: CVE-2021-20328 Source advisory: GHSA-RGHW-6PX2-FGWC...

ai.tock:bot-test (>=20.3.0, <=20.3.3), ai.tock:bot-test-base (>=20.3.0, <=20.3.3) +272 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=4.0.0, <=4.0.5)

org.mongodb:mongodb-driver-sync MAVEN version =4.0.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.3 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

ai.platon.commons:distributed-lock-example (>=1.4.2, <=1.4.3), ai.platon.commons:distributed-lock-mongo (>=1.4.2, <=1.4.3) +280 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=4.1.0, <=4.1.1)

org.mongodb:mongodb-driver-sync MAVEN version =4.1.0, =1.4.2, =1.4.2, =1.6.6, =1.6.6, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.9.2-1 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0, <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0, <=4.5.0) +40 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.12.0, <=3.12.7)

org.mongodb:mongodb-driver-sync MAVEN version =3.12.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1, =3.0.0-alpha-15, =3.0.0-alpha-15, =4.5.0, =5.2.1, =5.2.1, =0.9.0, =0.10.0 and more Source cves: CVE-2021-20328 Source advisory: GHSA-RGHW-6PX2-FGWC...

ai.tock:bot-test (>=20.3.0, <=20.3.3), ai.tock:bot-test-base (>=20.3.0, <=20.3.3) +272 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=4.0.0, <=4.0.5)

org.mongodb:mongodb-driver-sync MAVEN version =4.0.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.0, =20.3.3 and more Source cves: CVE-2021-20328 Source advisory: GHSA-RGHW-6PX2-FGWC...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2019-10401 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2019-10402 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2021-21685 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2021-21693 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...

com.dubture.jenkins:digitalocean-plugin (>=0.9, <=0.12), com.inkysea.vmware.vra:vmware-vrealize-automation-plugin (>=1.2.1, <=1.2.3) +8 more potentially affected by CVE-2021-21694 via org.jenkins-ci.main:jenkins-core (1.642.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.dubture.jenkins:digitalocean-plugin =0.9, =1.2.1, =0.0.8, =0.6, =2.4.2, =1.13-alpha, =0.1...