The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When
input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id
string leads to SQL injection.
The issue was already fixed from version 0.3.0 onward when we encountered it.
Maintainer does not consider this a vulnerability…
*🐞 CFP for Hardwear.io NL 2022 is OPEN!*
If you have groundbreaking embedded research or an awesome open-source tool
you’d like to showcase before the global hardware security community, this
is your chance. Send in your ideas on various hardware subjects, including
but not limited to Chips, Processors, ICS/SCADA, Telecom, Protocols &
Cryptography.
CFP is open until: 15 August 2022
Conference: 27-28 October 2022, The Hague (NL)
————————————————————————–
C a l l F o r P a p e r s
The Workshop on CPS&IoT Security and Privacy (CPSIoTSec 2022), in
conjunction with the ACM Conference on Computer and Communications
Security (ACM CCS)
November 7-11, 2022, Los Angeles, U.S.A. https://cpsiotsec2022.github.io/cpsiotsec/…
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Florian Kohnhuser discovered that curl incorrectly handled returning a
TLS server’s certificate chain details. A remote attacker could possibly
use this issue to cause curl to stop responding, resulting in a denial of
service. (CVE-2022-27781)
Harry Sintonen discovered that curl incorrectly handled certain FTP-KRB
messages. An attacker could possibly use this to perform a
machine-in-the-middle attack. (CVE-2022-32208)
