Malicious code in gd-activity-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be919ac20b6023e27b37ab04354acc2fe0d76aadf72ab3ccea2dafed5df390a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-24896

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retriev...

Design/Logic Flaw

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retriev...

Tuleap 安全漏洞

Tuleap is open source an application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. A security vulnerability exists in versions prior to Tuleap 13.7.99.239 that stems from Tuleap failing to...

CVE-2022-24896 Tracker report renderer and chart widgets leak information in Tuleap

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retriev...

CVE-2022-24896 Tracker report renderer and chart widgets leak information in Tuleap

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retriev...

CVE-2022-24896

CVE-2022-24896 affects Tuleap versions prior to 13.7.99.239. The vulnerability stems from improper authorization checks when displaying content in the Tracker Report Renderer and Chart widgets, allowing an attacker to disclose the name of trackers and the fields used in reports. Impact is informa...

[SECURITY] [DLA 3041-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3041-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort June 03, 2022 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3040-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3040-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort June 03, 2022 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 5154-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5154-1 [email protected] https://www.debian.org/security/ Alberto Garcia June 01, 2022 https://www.debian.org/security/faq -...

[SECURITY] [DLA 3037-1] libjpeg-turbo security update

Debian LTS Advisory DLA-3037-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 31, 2022 https://wiki.debian.org/LTS Package : libjpeg-turbo Version : 1:1.5.1-2+deb9u2 CVE ID : CVE-2019-2201 Several integer overflows have been discovered in TurboJPEG, a JPEG...

[SECURITY] [DLA 3033-1] smarty3 security update

Debian LTS Advisory DLA-3033-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 29, 2022 https://wiki.debian.org/LTS Package : smarty3 Version : 3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u6 CVE ID : CVE-2022-29221 Debian Bug : 1011758 Smarty3 is a template engi...

Experts Detail New RCE Vulnerability Affecting Google Chrome Dev Channel

Details have emerged about a recently patched critical remote code execution vulnerability in the V8 JavaScript and WebAssembly engine used in Google Chrome and Chromium-based browsers. The issue relates to a case of use-after-free in the instruction optimization component, successful exploitatio...

[SECURITY] [DLA 3030-1] zipios++ security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3030-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz May 27, 2022 https://wiki.debian.org/LTS -...

Reversible One-Way Hash in io.github.javaezlib:JavaEZ

Impact This weakness allows the force decryption of locked text by hackers. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. Upgrading...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the managecustomfieldeditpage.php. An attacker can inject malicious scripts into a hidden input field by manipulating the unescaped output of the return parameter...

Insecure Storage of Sensitive Information

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Insecure Storage of Sensitive Information via the manageprojeditpage.php parameter. An attacker can retrieve private project names without proper access rights by manipulating the projectid...

Incorrect Authorization

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient access-level checks in the bugactiongrouppage.php URL. An attacker can gain access to the Summary fields of private Issues by crafting a URL with...

Incorrect Authorization

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Incorrect Authorization through the bugrevisionviewpage.php check. An attacker can gain access to potentially confidential information by manipulating the bugnoteid parameter. Remediation Upgra...

SQL Injection

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to SQL Injection via the mcprojectgetusers function. An attacker can manipulate SQL queries and access or alter database information without proper authorization by injecting malicious SQL command...