SUSE-SU-2023:4386-1 Security update for salt

This update for salt fixes the following issues: Security issues fixed: - CVE-2023-34049: arbitrary code execution via symlink attack bsc1215157 Bugs fixed: - Fix optimizationorder opt to prevent testsuite fails - Improve salt.utils.json.findjson to avoid fails bsc1213293 - Use salt-call from sal...

PT-2023-35550 · Git +1 · Php

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash, specifically a Segv on an unknown address, which occurs during the execution of certain functions, including cleanup liv...

PT-2023-24191

Name of the Vulnerable Software and Affected Versions ToUI versions 2.0.1 through 2.4.0 Description The issue affects websites that use the Website.user vars property. ToUI utilizes Flask-Caching SimpleCache to store user variables, which are stored on the server side. Recommendations For version...

Jenkins Plugin Ansible 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

sudo: arbitrary file write with privileges of the RunAs user

A vulnerability was found in sudo. Exposure in how sudoedit handles user-provided environment variables leads to arbitrary file writing with privileges of the RunAs user usually root. The prerequisite for exploitation is that the current user must be authorized by the sudoers policy to edit a fil...

PT-2022-26782 · Unknown · Rukovoditel

Name of the Vulnerable Software and Affected Versions: Rukovoditel version 3.2.1 Description: A stored cross-site scripting XSS issue in the Global Variables feature, specifically at the "/index.php?module=global vars/vars" endpoint, allows authenticated attackers to execute arbitrary web scripts...

Malicious code in eslint-plugin-translation-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2d3f1b78d30920863239e9f77d1fb8208df96b4cf0e41bf69fd693bba483041 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2828 Malicious code in eslint-plugin-translation-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2d3f1b78d30920863239e9f77d1fb8208df96b4cf0e41bf69fd693bba483041 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview eslint-plugin-translation-vars is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

MAL-2022-879 Malicious code in aer_css-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 738bc82bab4a25f844c6d1a87c9e76378b88d9af0808818534af9c2fcc4b1863 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in get-lodash-template-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7916d6bceee662db12088e55ab01e3ad32487d802c99bf7dc60e63c156d5bf0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2021-11275

Name of the Vulnerable Software and Affected Versions: TrippLite SU2200RTXL2Ua version 12.04.0055 Description: A stored cross-site scripting XSS issue was found in the /Forms/device vars 1 endpoint. This allows authenticated attackers to obtain other users' information by sending a crafted POST...

CVE-2020-21054

FusionPBX 4.5.7 contains a Cross-Site Scripting (XSS) vulnerability exploitable via an unsanitized variable f in app/vars/vars_textarea.php. Affects multiple CVE mirrors (CVE-2020-21054) with consistent description across NVD, Red Hat, CNVD and other feeds. Impact is to inject arbitrary web scrip...

Malicious Package

Overview paychex-app-common-html is a malicious package. It uses a preinstall script to steal environment variables. Remediation Avoid using all malicious instances of the paychex-app-common-html package. Credit: Snyk Research...

CVE-2021-3124

Stored cross-site scripting XSS in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via the vars0name field...

WordPress Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability in WordPress 1.0.5 in Swapnil Subhash Bodekar can be exploited ...

CVE-2017-16060

CVE-2017-16060 describes the npm package babelcli, a malware package designed to hijack environment variables. The connected documents confirm that babelcli steals environment variables and exfiltrates them to attacker-controlled locations, and that all versions were unpublished from the npm regi...

CVE-2016-10547

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting XSS vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as name=alert1, it is possible to...

Carbon Black’s Victor Baez Recognized as a 2018 CRN Channel Chief

CRN®, a brand of The Channel Company, has named Victor Baez, Vice President, WW Channels of Carbon Black, to its prestigious list of 2018 Channel Chiefs. The executives on this annual list represent top leaders in the IT channel who excel at driving growth and revenue in their organization throug...

SUSE SLES11 Security Update : openssh (SUSE-SU-2016:1528-1)

openssh was updated to fix three security issues. These security issues were fixed : - CVE-2016-3115: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH allowed remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related t...