Red Hat Enterprise Linux : Enabled Official Repositories

The remote host is using one or more official Red Hat repositories to install packages. These repositories will be used in conjunction with Red Hat OS package level assessment security advisories to determine whether or not relevant repositories are installed before checking package versions for...

UBUNTU-CVE-2021-3421

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This...

EulerOS 2.0 SP8 : git (EulerOS-SA-2021-1870)

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as...

[SECURITY] Fedora 33 Update: skopeo-1.2.3-1.fc33

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...

block repositories using http by default

...

DEBIAN-CVE-2021-26291

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

CVE-2021-26291

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

UBUNTU-CVE-2021-26291

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

CVE-2021-26291

CVE-2021-26291: Apache Maven could allow a remote attacker to bypass security restrictions by default non-SSL (http) repository references. Affected IBM/Bundled deployments cite this vulnerability and provide remediation paths, including upgrading Maven-driven components to versions that include ...

PT-2021-7897

Name of the Vulnerable Software and Affected Versions Apache Maven versions prior to 3.8.1 Description The issue is related to shortcomings in the mechanism of confirming the source of data in the Apache Maven framework. Exploitation of this issue may allow a remote attacker to gain unauthorized...

Vulnerablecode - A Free And Open Vulnerabilities Database And The Packages They Impact And The Tools To Aggregate And Correlate These Vulnerabilities

VulnerableCode is a free and open database of FOSS software package vulnerabilities and the tools to create and keep the data current. It is made by the FOSS community to improve and secure the open source software ecosystem. Why? The existing solutions are commercial proprietary vulnerability...

FreeBSD : Apache Maven -- multiple vulnerabilities (20006b5f-a0bc-11eb-8ae6-fc4dd43e2b6a)

The Apache Maven project reports : We received a report from Jonathan Leitschuh about a vulnerability of custom repositories in dependency POMs. We've split this up into three separate issues : - Possible Man-In-The-Middle-Attack due to custom repositories using HTTP. More and more repositories u...

SUSE: Security Advisory (SUSE-SU-2017:2040-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:3147-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-29427

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies...

CVE-2021-29427

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what repositories are used to resolve specific dependencies...

Apache Maven -- multiple vulnerabilities

The Apache Maven project reports: We received a report from Jonathan Leitschuh about a vulnerability of custom repositories in dependency POMs. We've split this up into three separate issues: Possible Man-In-The-Middle-Attack due to custom repositories using HTTP. More and more repositories use...

Malicious Docker Cryptomining Images Rack Up 20M Downloads

At least 30 malicious images in Docker Hub, with a collective 20 million downloads, have been used to spread cryptomining malware, according to an analysis. The malicious images spread across 10 different Docker Hub accounts have raked in around $200,000 from cryptomining, according to Aviv Sasso...

PHP Infiltrated with Backdoor Malware

The PHP project on Sunday announced that attackers were able to gain access to its main Git server, uploading two malicious commits, including a backdoor. They were discovered before they went into production. PHP is a widely used open-source scripting language often used for web development. It...

Mimecast Finds SolarWinds Hackers Stole Some of Its Source Code

Email security firm Mimecast on Tuesday revealed that the state-sponsored SolarWinds hackers who broke into its internal network also downloaded source code out of a limited number of repositories. "The threat actor did access a subset of email addresses and other contact information and hashed a...