| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data. |
| This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within an exposed RMI registry, which listens on TCP ports 1800 and 1850 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Was ZDI-CAN-4753. |
| File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to obtain other user's sensitive files via the filename parameter. |
| Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured routes, that can be edited remotely via ADS. This special command supports encrypted authentication with username/password. The encryption uses a fixed key, that could be extracted by an attacker. Precondition of the exploitation of this weakness is network access at the moment a route is added. |
| In Ice Qube Thermal Management Center versions prior to version 4.13, passwords are stored in plaintext in a file that is accessible without authentication. |
| discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin. |
| The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
| The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
| The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
| The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation. |
| The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry. |
| The module pandora-doomsday infects other modules. It's since been unpublished from the registry. |
| cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
| crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
