Malicious Package

Overview state.aggregator is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one ...

GHSA-JVXX-V45P-V5VF Denial of Service (DoS) vulnerability in RSSHub

Impact Passing some special values to the filter and filterout parameters can cause an abnormally high CPU. Impact on the performance of the servers and RSSHub services. Patches It is fixed in 5c4177441417b44a6e45c3c63e9eac2504abeb5b , please update to this or the later versions as soon as...

PT-2022-20535 · Rsshub · Rsshub

Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to 5c4177441417 Description: The issue arises when special values are passed to the filter and filterout parameters, causing abnormally high CPU usage. This impacts the performance of servers and RSSHub services,...

MAL-2022-6860 Malicious code in usage-tracker-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d8df5ba36a0e32ee17b381dd4aecaf374318fa041a1746ca1c6f38cff660fcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in usage-tracker-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d8df5ba36a0e32ee17b381dd4aecaf374318fa041a1746ca1c6f38cff660fcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in usage-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cebfa7512b7fefffab99cc04eaba7ff09ffc6aa9d19f633010c3314b14c3363e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6859 Malicious code in usage-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cebfa7512b7fefffab99cc04eaba7ff09ffc6aa9d19f633010c3314b14c3363e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

InvenTree 资源管理错误漏洞

InvenTree is an open source inventory management system from InvenTree Open Source. Provides powerful low-level inventory control and parts tracking . A denial of service vulnerability exists in InvenTree versions prior to 0.8.0 that stems from the annotations feature not including a character...

PT-2022-14950 · Inventree · Inventree

Name of the Vulnerable Software and Affected Versions: inventree versions prior to 0.8.0 Description: The issue concerns the allocation of resources without limits or throttling, leading to a Denial of Service. This can cause the system to become unresponsive or crash. Recommendations: For versio...

Lack of Character Limit in Notes Sections Leads to Denial of Service

Description The InvenTree application allows for the inclusion of notes for various objects in the application. The notes functionality does not include a character limit. An attacker can submit an infinite number of characters into the notes section, which causes a denial of service and increase...

Upgraded Q -> M from 91 [1655579814367]

Judge has assessed an item in Issue 91 as Medium risk. The relevant finding follows: use call instead of send affected code: Use of transfer might render ETH impossible to withdraw because after istanbul hardfork , there is increases in the gas cost of the SLOAD operation and therefore breaks som...

artemis-commons: Apache ActiveMQ Artemis DoS

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability DoS through uncontrolled resource consumption of memory...

CVE-2022-20193

In getUniqueUsagesWithLabels of PermissionUsageHelper.java, there is a possible incorrect permission attribution due to a logic error in the code. This could lead to local escalation of privilege by conflating apps with User execution privileges needed. User interaction is needed for...

About the security content of Apple Music 3.9.10 for Android

About the security content of Apple Music 3.9.10 for Android This document describes the security content of Apple Music 3.9.10 for Android. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred...

Argo 缓冲区错误漏洞

Argo is an open source container native workflow engine. A buffer error vulnerability in Kubernetes Argo Events prior to version 1.7.1, which stems from ioutil.ReadAll reading all data into memory, can be exploited by an attacker to send a large number of requests to the Argo Events server,...

CVE-2022-30780

Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service CPU consumption from stuck connections because connectionreadheadermore in connections.c has a typo that disrupts use of multiple read operations on large headers...

Jeeves - Time-Based Blind SQLInjection Finder

Jeeves is made for looking to Time-Based Blind SQLInjection through recon. - Installation & Requirements: Installing Jeeves  $ go install github.com/ferreiraklet/Jeeves@latest OR $ git clone https://github.com/ferreiraklet/Jeeves.git $ cd Jeeves $ go build jeeves.go $ chmod +x jeeves $ ./jeeves...

PT-2022-7123

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 3.9.0 Description The issue is related to the execution of parse content stream which can lead to an infinite loop if a crafted PDF is used. This can occur, for example, when a user extracts text from such a PDF. The...

Swftools Use After Release Vulnerability

Swftools is a set of utilities for working with Adobe Flash files SWF files. A post-release use vulnerability exists in Swftools 2020-12-22 and prior versions, which stems from a heap-based post-release reuse issue in the function swfFontExtractDefineTextCallback located in swftext.c. The...

CVE-2022-28614

The aprwrite function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using aprwrite or aprputs, such as with modluas r:puts function. Modules compiled and distributed separately from Apache HTTP Server that use t...