Sensitive Information Disclosure

laf-client-sdk is vulnerable to Sensitive Information Disclosure. The vulnerability is caused due to directly inserting env variables into the the template while constructing the deployment instance of the app. Sensitive information in the secret and configmap can be read through the k8s envFrom...

CVE-2023-48225

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

Laf Information Disclosure Vulnerability

Laf is a cloud development platform from labring labs. An information disclosure vulnerability exists in versions prior to Laf 1.0.0-beta.13. The vulnerability stems from lax control of the LAF application enV, which leads to the disclosure of sensitive information in the configmap...

CVE-2021-4430

A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js of the component ENV Variable Handler. The manipulation leads to information disclosure. Upgrading to version 3.1.7 is able to address th...

Design/Logic Flaw

A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js of the component ENV Variable Handler. The manipulation leads to information disclosure. Upgrading to version 3.1.7 is able to address th...

CVE-2021-4430 Ortus Solutions ColdBox Elixir ENV Variable defaultConfig.js information disclosure

A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js of the component ENV Variable Handler. The manipulation leads to information disclosure. Upgrading to version 3.1.7 is able to address th...

Debian DSA-5528-1 : node-babel7 - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5528 advisory. - Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile...

Code injection

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

CVE-2023-45133

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

CVE-2023-45133

CVE-2023-45133 affects Babel’s traversal layer. The issue allows arbitrary code execution during compilation when compiling code crafted by an attacker via plugins that rely on path.evaluate() or path.evaluateTruthy(). Affected in: @babel/traverse prior to 7.23.2 and 8.0.0-alpha.4, and all versio...

CVE-2023-45133 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

Admin account TakeOver

Description The endpoint api/system/update-env allows any authenticated users to change env variables of the back-end process : js process.envenvKey = value; The envKey value comes from here : js const envKey, checks = KEYMAPPINGkey; One of the value in the KEYMAPPING dictionnary is : js JWTSecre...

MAL-2023-8075 Malicious code in portal-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 768a95f370e1b55036ea06a3987092eb217f0a763c28953fcf3bb8c11fb0c580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in portal-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 768a95f370e1b55036ea06a3987092eb217f0a763c28953fcf3bb8c11fb0c580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-804 Malicious code in sportsbook-env-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d79654ab4931607762a27f2b9d074eb3e78eab79c6ae9d6799541d54612c3bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sportsbook-env-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d79654ab4931607762a27f2b9d074eb3e78eab79c6ae9d6799541d54612c3bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-307 Malicious code in env-cross (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dfac7391de71e5fbbea3c5880d76d0fada380dc4026cd39541ac9684098b56e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in env-cross (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dfac7391de71e5fbbea3c5880d76d0fada380dc4026cd39541ac9684098b56e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Elastic Kibana < 8.7.1 Arbitrary Code Execution

The Elastic Kibana software on the remote host is missing a security update. It is, therefore, affected by multiple arbitrary code execution vulnerabilities: - An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This...

LLVM project 缓冲区错误漏洞

LLVM project is a collection of modular, reusable compiler and toolchain technologies open-sourced by LLVM. A security vulnerability exists in LLVM project version a0138390, which stems from a segmentation error in the component mlir::spirv::TargetEnv::TargetEnvmlir::spirv::TargetEnvAttr...