GHSA-725F-3PW7-RQ6X Malicious Package in 8.9.4

Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of 8.9.4 contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server. Recommendation Remove the package from your environment. There is no evidence of further compromise at the moment...

Potential Command Injection in libnotify

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify. Untrusted input passed in the call to libnotify.notify could result in execution of shell...

GHSA-6QQJ-RX4W-R3CJ CSRF Vulnerability in jquery-ujs

Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains. When an attacker controls the href attribute of an anchor tag, or the action attribute of a fo...

PT-2020-5832 · Jenkins · Jenkins Flaky Test Handler Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Flaky Test Handler Plugin versions 1.0.4 and earlier Description: The issue is related to a cross-site request forgery CSRF vulnerability in the "Deflake this build" feature of the Jenkins Flaky Test Handler Plugin. This vulnerability...

NETGEAR R6700 Buffer Overflow Vulnerability (CNVD-2020-45110)

The NETGEAR R6700 is a wireless router from NETGEAR. A buffer overflow vulnerability exists in the UPnP service in the NETGEAR R6700 version V1.0.4.8410.0.58, which stems from the program failing to properly validate the length of user-submitted data before copying it to a fixed stack-based buffe...

SRS Simple Hits Counter <= 1.0.4 - Unauthenticated Blind SQL Injection

Alex Peña from Tenable discovered a blind SQL injection which could allow unauthenticated remote attackers to retrieve data from the DBMS. Note: The vendor attempted a fix in v1.0.4, which is incomplete. PoC The PoC will be displayed once the issue has been remediated...

WindowsHello open source library encryption issue vulnerability

WindowsHello is an unlocking open source library for use with the Windows Hello biometric facial recognition library. A vulnerability exists in the WindowsHello open source library NuGet HaemmerElectronics.SeppPenner.WindowsHello prior to version 1.0.4 due to a cryptographic issue. An attacker ca...

CVE-2020-11005

The WindowsHello open source library NuGet HaemmerElectronics.SeppPenner.WindowsHello, before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and write the output to a txt file, another...

Internal NCryptDecrypt method could be used externally from WindowsHello library.

Impact Every user of the library before version 1.0.4. Patches Patched in 1.0.4+. Workarounds None. References https://github.com/SeppPenner/WindowsHello/issues/3 For more information It this library is used to encrypt text and write the output to a txt file, another executable could be able to...

Effect Command Injection Vulnerability

effect is a node program package that allows you to add effects to your images. A command injection vulnerability exists in effect 1.0.4 and earlier. The vulnerability can be exploited to execute arbitrary commands via the options parameter...

CVE-2020-7624

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument...

CVE-2020-7624

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument...

PT-2021-6496 · Libde265 +4 · Libde265 +4

Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.4 Description: The issue is related to a heap buffer overflow in the ff hevc put unweighted pred 8 sse function. This can be exploited via a crafted file, potentially allowing a remote attacker to access confidential data...

CloudBees Jenkins Pipeline GitHub Notify Step Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . A cross-site request forgery vulnerability exists in Pipeline GitHub Notify Step Plugin 1.0.4 and earlier versions in CloudBees Jenkins. The vulnerability stems...

PT-2020-15325 · Jenkins · Jenkins Pipeline Github Notify Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier Description: A missing permission check in form-related methods of the Jenkins Pipeline GitHub Notify Step Plugin allowed users with Overall/Read access to enumerate...

PT-2020-15323 · Jenkins · Jenkins Pipeline Github Notify Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier Description: A cross-site request forgery issue allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, potentially capturing...

PT-2020-15324 · Jenkins · Jenkins Pipeline Github Notify Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline GitHub Notify Step Plugin versions 1.0.4 and earlier Description: A missing permission check in the plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified...

PT-2019-6199 · Struktur Ag +4 · Libde265 +4

Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.4 Description: The issue is related to a global buffer overflow in the decode CABAC bit function. This can be exploited via a crafted file, potentially allowing a remote attacker to cause a denial of service. The...

PT-2019-6187 · Struktur Ag +4 · Libde265 +4

Name of the Vulnerable Software and Affected Versions: libde265 version 1.0.4 Description: The issue is related to a heap buffer overflow in the put qpel 0 0 fallback 16 function. This can be exploited by a remote attacker using a specially crafted file, potentially leading to a denial of service...

PT-2019-6198 · None +3 · Libde265 +3

Name of the Vulnerable Software and Affected Versions: libde265 version v1.0.4 Description: The issue is related to a heap buffer overflow in the put epel hv fallback function, which can be exploited via a crafted file, potentially allowing a remote attacker to cause a denial of service...