Malicious code in import-wasm-static (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9665 Malicious code in import-wasm-static (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9510 Malicious code in atlassian-static-assets-url-plugin (npm)

--- -= Per source details. Do not edit below this line.=-...

serve-static affected by template injection that can lead to XSS

...

spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource

A flaw was found in Spring applications using the WebMvc.fn or WebFlux.fn frameworks. This issue can allow attackers to perform path traversal attacks via crafted HTTP requests when the application serves static resources using RouterFunctions and explicitly configures resource handling with a...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.34.0 security update & enhancements

Release of OpenShift Serverless Logic 1.34.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

GO-2024-3182 OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu...

cosmicdbsemantic (>=0.0.24, <=0.0.29), django-markdown-messaging (0.0.1) +3 more potentially affected by CVE-2024-45231 via django (2.0.6)

django PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.24, =0.0.4, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

CVE-2024-47822

CVE-2024-47822 – Directus : The issue arises from access tokens in query strings not being redacted when LOG_STYLE is set to raw, allowing potential exposure of long‑lived tokens in system logs. This could enable an attacker with log access to gain administrative control or perform unauthorized d...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.11

Red Hat OpenShift Service Mesh Containers for 2.4.11 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift...

CVE-2024-41594

An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL...

GHSA-WPR2-J6GR-PJW9 OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

Impact Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors. Workarounds Check that you are not using sensitive...

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

Impact Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors. Workarounds Check that you are not using sensitive...

DrayTek Vigor 3910 安全漏洞

The DrayTek Vigor 3910 is a high-performance router for enterprise networks from China-based DrayTek. A security vulnerability exists in the DrayTek Vigor 3910 version 4.3.2.6 and prior versions, which originates from the Vigor Management UI's httpd server using static strings to seed OpenSSL's...

PT-2026-73142

Name of the Vulnerable Software and Affected Versions OpenTofu versions 1.8.0 through 1.8.2 Description Sensitive variables and locals are not properly restricted when static evaluation of module sources, versions, and backend configurations is enabled. This allows values marked as sensitive to b...

CVE-2024-41594: Inadequate Encryption Strength

An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigor management UI uses a static string for seeding the PRNG of OpenSSL...

xmlsec1 bug fix update

An update is available for xmlsec1. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list XML Security Library is a C library based on LibXML2 and OpenSSL. The library...

SUSE CVE-2024-46836

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis...

CVE-2024-46836

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis...

DEBIAN-CVE-2024-46836

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis...