6142 matches found
Mageia: Security Advisory (MGASA-2024-0147)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Assessing the Y, and How, of the XZ Utils incident
High-end APT groups perform highly interesting social engineering campaigns in order to penetrate well-protected targets. For example, carefully constructed forum responses on precision targeted accounts and follow-up "out-of-band" interactions regarding underground rail system simulator software...
RHEL 8 : OpenShift Container Platform 4.9.55 (RHSA-2023:0573)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:0573 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...
Debian dla-3784 : caca-utils - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3784 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3784-1 [email protected]...
@audius/sdk (0.0.36), @cardinal/squads-utils (>=0.0.2, <=0.0.6) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.53.0)
@solana/web3.js NPM version 1.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @audius/sdk 0.0.36 - @cardinal/squads-utils =0.0.2, =0.0.6 - @snowflake-so/wallet-adapter-snowflake 1.0.12 Source cves:...
OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt
Security researchers have uncovered a "credible" takeover attempt targeting the OpenJS Foundation in a manner that evokes similarities to the recently uncovered incident aimed at the open-source XZ Utils project. "The OpenJS Foundation Cross Project Council received a suspicious series of emails...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-1558 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-1558 Source advisory: OSV:GHSA-J62R-WXQQ-F3GF...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-1594 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-1594 Source advisory: OSV:GHSA-M49C-5C52-6696...
XZ Utils supply chain attack
Red Hat team released a security advisory for a supply chain compromise discovered in the XZ Utils library versions 5.6.0 and 5.6.1. The issue was assigned CVE-2024-3094. Acronis security team concluded that Acronis infrastructure and products are not affected by this vulnerability...
Popular Rust Crate liblzma-sys Compromised with XZ Utils Backdoor Files
"Test files" associated with the XZ Utils backdoor have made their way to a Rust crate known as liblzma-sys, new findings from Phylum reveal. liblzma-sys, which has been downloaded over 21,000 times to date, provides Rust developers with bindings to the liblzma implementation, an underlying libra...
USN-6730-1 maven-shared-utils vulnerability
It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code...
USN-6730-1: Apache Maven Shared Utils vulnerability
It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code...
Backdoor in XZ Utils That Almost Happened
Last week, the Internet dodged a major nation-state attack that would have had catastrophic cybersecurity repercussions worldwide. It’s a catastrophe that didn’t happen, so it won’t get much attention--but it should. There’s an important moral to the story of the attack and its discovery: The...
GHSA-WVPX-G427-Q9WC llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
The vulnerability of the shadow-utils package, related to incorrect authentication, allows a hacker to gain unauthorized access to user passwords.
The vulnerability of the shadow-utils package is related to the double password request and the lack of buffer memory cleanup. Exploiting this vulnerability can allow an attacker to gain unauthorized access to user passwords...
LlamaIndex 代码注入漏洞
LlamaIndex is a data framework for an LLM application by the individual developer Jerry Liu. A code injection vulnerability exists in LlamaIndex that stems from insufficient input validation of the safeeval function in executils, which allows injection at the prompt, leading to arbitrary code...
ROS-20240409-07
A vulnerability in the shadow-utils package is related to requesting the password twice and not clearing the memory buffer. Exploitation of the vulnerability could allow an attacker to gain access to the device...
USN-6658-1: libxml2 vulnerability | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that libxml2 incorrectly handled certain XML documents. A remote attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute...
