96 matches found
GHSA-97X9-59RV-Q5PM Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
Impact When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs, the result of verifying the presentation document.proof was not factored into the final verified value true/false on the presentation record. Below is an example result from verifying a JSON-LD...
PT-2024-19011
Name of the Vulnerable Software and Affected Versions Hyperledger Aries Cloud Agent Python ACA-Py versions 0.7.0 through 0.10.4 Description The issue arises when verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs LDP-VCs. The result of verifying the presentation...
aries-askar (>=0.1.2, <=0.2.7), arkworks-r1cs-gadgets (>=0.5.0, <=1.2.0) +108 more potentially affected by unknown CVE via xsalsa20poly1305 (>=0.4.2, <=0.9.1)
xsalsa20poly1305 CARGO version =0.4.2, =0.1.2, =0.5.0, =0.5.0, =0.2.0-pre.1, =0.1.0, =0.1.0, =0.1.1 - bramble-handshake 0.1.0 - bramble-qr 0.1.0 - bramble-rendezvous 0.1.0 - bramble-sync 0.1.0 - bramble-transport 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0037...
Why is ‘Juice Jacking’ Suddenly Back in the News?
KrebsOnSecurity received a nice bump in traffic this week thanks to tweets from the Federal Bureau of Investigation FBI and the Federal Communications Commission FCC about "juice jacking," a term first coined here in 2011 to describe a potential threat of data theft when one plugs their mobile...
SUSE CVE-2020-10672
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory aka aries.transaction.jms...
Malicious Package
Overview aries-askar-shared is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...
Malicious code in aries-bifold (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 251d46e3496d63c9b3598599b630afca002cc225ef387f8b8db2932e544fbc1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1088 Malicious code in aries-bifold (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 251d46e3496d63c9b3598599b630afca002cc225ef387f8b8db2932e544fbc1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Hyperledger: Dependency confusion in https://github.com/hyperledger/aries-mobile-agent-react-native
Vulnerability description not provided...
MAL-2022-1087 Malicious code in aries-askar-shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec7e85602fc5ad6913bd9bd909f95910a70ba3e3334f0b5f07195924ba097479 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in aries-askar-shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec7e85602fc5ad6913bd9bd909f95910a70ba3e3334f0b5f07195924ba097479 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2022-31871
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.121 Description A refcount leak was discovered in the aries audio probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...
PT-2022-31370
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.14 Description A refcount leak was discovered in the aries audio probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...
PT-2022-31666
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.46 Description The issue is related to a refcount leak in the aries audio probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior ...
PT-2022-31022
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description A refcount leak was discovered in the aries audio probe function. The issue was introduced in version v5.9 and is fixed in Linux Kernel version v5.18.3. The actual impact and attack plausibili...
aries-mobile.de Cross Site Scripting vulnerability OBB-1327565
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
en.aries.eu Cross Site Scripting vulnerability OBB-1217459
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
ariesmarine.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1160577 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
GHSA-95CM-88F5-F2C7 jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory aka aries.transaction.jms...
FasterXML jackson-databind deserialization vulnerability (CNVD-2020-24667)
FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A security vulnerability exists in FasterXML jackson-databind version 2.x prior to 2.9.10.4, which originates in...