CVE-2022-31082

GLPI and its glpi-inventory-plugin are affected by CVE-2022-31082 due to a SQL injection via package deployment tasks. The issue affects versions prior to 1.0.2 and is fixed in 1.0.2; upgrade is advised. As a workaround for users unable to upgrade, delete front/deploypackage.public.php if the dep...

GLPI SQL注入漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, telephones, and even toner...

Malicious Package

Overview angieslist-gulp-build-tasks is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

Natural Language Processing and “Mindful” AI Drive More Sophisticated Bad Bot Attacks

The evolution from human to bot attacks Over the last several years of my career in cyber security, I have been fortunate to work with professionals who researched and developed new cyber security detection and prevention solutions that block high-end cyber attacks. Initially, these attacks were...

Defending Against Scheduled Task Attacks in Windows Environments

Scheduling tasks is one of the most popular attack techniques used by threat actors to establish persistence on a victim’s machine. The Qualys Research Team investigated different ways that attackers could use to conceal scheduled tasks. In this blog, we describe three new techniques to hide and...

Malicious code in jekyll-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c629b26c543b22356962ce77a870362389479e92da12b82ac9f77a9fb8bb0a8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4011 Malicious code in jekyll-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c629b26c543b22356962ce77a870362389479e92da12b82ac9f77a9fb8bb0a8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in common-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e55c898f659be0c1b99095443b479398de9f5feb6738daf3ad505a7040f7f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2125 Malicious code in common-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e55c898f659be0c1b99095443b479398de9f5feb6738daf3ad505a7040f7f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS) - Stored

Description Titra is vulnerable to Stored XSS in the Task field when creating a new task in a project. Steps to reproduce 1.In the Overview tab, click on New project button. 2.Enter a project name and click Save. 3.Move to the Tasks tab in that project and click on New Task button. 4.In the Task...

CVE-2021-30342

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables...

Race condition

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT...

Race condition

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2022-62757)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite 7.10.4 and prior...

Introducing EDR for Linux: Remediating and isolating threats on Linux servers

We’re excited to announce our new EDR for Linux offering, which extends our advanced protection and response capabilities to Linux devices via Nebula and OneView. In this post, we show you what remediating and isolating threats on Linux servers looks like with Malwarebytes EDR for Linux. Let’s ge...

PT-2022-19979

Name of the Vulnerable Software and Affected Versions Flower versions prior to 1.2.0 Description The issue is related to an OAuth authentication bypass in Flower, a web UI for the Celery Python RPC framework. This allows an attacker to access the Flower API, enabling them to discover and invoke...

System command execution vulnerability in Selection tasks Jenkins Plugin

Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as...

GHSA-79H8-7735-V3F9 System command execution vulnerability in Selection tasks Jenkins Plugin

Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as...

GHSA-MW4R-5MFC-M5VC Cross site scripting in Jenkins Selection tasks Plugin

Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters. This results in stored cross-site scripting XSS vulnerabilities exploitable by attackers with Item/Configure permission. Exploitatio...

Cross site scripting in Jenkins Selection tasks Plugin

Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters. This results in stored cross-site scripting XSS vulnerabilities exploitable by attackers with Item/Configure permission. Exploitatio...