| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function. |
| OpenRC opentmpfiles through 0.1.3, when the fs.protected_hardlinks sysctl is turned off, allows local users to obtain ownership of arbitrary files by creating a hard link inside a directory on which "chown -R" will be run. |
| systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file. |
| Homeputer CL Studio fur HomeMatic 4.0 Rel 160808 and earlier uses cleartext to exchange the username and password between server and client instances, which allows remote attackers to obtain sensitive information via a man in the middle attack. |
| BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data. |
| This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within an exposed RMI registry, which listens on TCP ports 1800 and 1850 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Was ZDI-CAN-4753. |
| File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to obtain other user's sensitive files via the filename parameter. |
| Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured routes, that can be edited remotely via ADS. This special command supports encrypted authentication with username/password. The encryption uses a fixed key, that could be extracted by an attacker. Precondition of the exploitation of this weakness is network access at the moment a route is added. |
| In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible without authentication. |
| discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin. |
| The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
| The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
| The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
| The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
| The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry. |
| The module pandora-doomsday infects other modules. It's since been unpublished from the registry. |
| cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
