Malicious code in @manomano-toolbox/async-exports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ed6043d62007fd2c0e9cbb7d2c4c3f699d6f97ae27a7f8cc5744c19e9128c6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authentication flaw

Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, as the code is not using await t...

CVE-2022-31013 Authentication bypass in Vartalap chat-server

Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, as the code is not using await t...

CVE-2022-31013 Authentication bypass in Vartalap chat-server

Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, as the code is not using await t...

PT-2022-20458

Name of the Vulnerable Software and Affected Versions Chat Server versions 2.3.2 through 2.5.x Description The issue concerns a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, but the code does not use...

qemu security update

15:4.2.1-17.el7 - arm/acpi: fix an out of spec UID for PCI root Michael S. Tsirkin - arm/acpi: fix duplicated UID of PCI interrupt link devices Heyi Guo - arm/acpi: fix PCI PRT definition Heyi Guo - docs: fix references to docs/devel/atomics.rst Stefano Garzarella Orabug: 33659123 - rcu: do not...

ALBA-2022:4744 sos bug fix and enhancement update

The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging. Bug Fixes and Enhancements: sos collect fails to get node list from a pacemaker cluster BZ2071695 Tracke...

io.github.ryan-za:async-elastic-orm (0.2.2) potentially affected by CVE-2021-22137 via org.elasticsearch:elasticsearch (1.0.0.beta2)

org.elasticsearch:elasticsearch MAVEN version 1.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - io.github.ryan-za:async-elastic-orm 0.2.2 Source cves: CVE-2021-22137 Source advisory:...

io.github.ryan-za:async-elastic-orm (0.2.2) potentially affected by CVE-2020-7021 via org.elasticsearch:elasticsearch (1.0.0.beta2)

org.elasticsearch:elasticsearch MAVEN version 1.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - io.github.ryan-za:async-elastic-orm 0.2.2 Source cves: CVE-2020-7021 Source advisory:...

Async-h1 request smuggling possible with long unread bodies

An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy...

GHSA-C8RQ-CRXJ-MJ9M Async-h1 request smuggling possible with long unread bodies

An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy...

io.github.ryan-za:async-elastic-orm (0.2.2) potentially affected by CVE-2020-7019 via org.elasticsearch:elasticsearch (1.0.0.beta2)

org.elasticsearch:elasticsearch MAVEN version 1.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - io.github.ryan-za:async-elastic-orm 0.2.2 Source cves: CVE-2020-7019 Source advisory:...

io.github.ryan-za:async-elastic-orm (0.2.2) potentially affected by CVE-2019-7614 via org.elasticsearch:elasticsearch (1.0.0.beta2)

org.elasticsearch:elasticsearch MAVEN version 1.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - io.github.ryan-za:async-elastic-orm 0.2.2 Source cves: CVE-2019-7614 Source advisory:...

org.grails:grails-logging (2.3.10), org.grails:grails-plugin-async (2.3.10) +19 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.3.10)

org.grails:grails-core MAVEN version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-logging 2.3.10 - org.grails:grails-plugin-async 2.3.10 - org.grails:grails-plugin-codecs 2.3.10 ...

org.grails:grails-dependencies (2.4.0.rc1), org.grails:grails-encoder (2.4.0.rc1) +33 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.4.0.rc1)

org.grails:grails-core MAVEN version 2.4.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.0.rc1 - org.grails:grails-encoder 2.4.0.rc1 -...

org.grails:grails-dependencies (2.5.1), org.grails:grails-encoder (2.5.1) +33 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.5.1)

org.grails:grails-core MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.5.1 - org.grails:grails-encoder 2.5.1 - org.grails:grails-logging 2.5.1 -...

org.grails:grails-datastore-gorm-grails2-support (>=6.1.0.release, <=6.1.9.release), org.grails:grails-datastore-gorm-grails2-test (>=6.1.0.release, <=6.1.9.release) +35 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.5.6)

org.grails:grails-core MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm-grails2-support =6.1.0.release, =6.1.0.release, =6.1.9.release -...

org.grails:grails-datastore-gorm (>=3.1.3.release, <=3.1.5.release), org.grails:grails-datastore-gorm-cassandra (1.0.0-m01) +31 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.3.11)

org.grails:grails-core MAVEN version 2.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-datastore-gorm =3.1.3.release, =3.1.3.release, =3.1.3.release, =3.1.3.release, =3.1.4.release,...

org.grails:grails-logging (2.4.0.m1), org.grails:grails-plugin-async (2.4.0.m1) +19 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.4.0.m1)

org.grails:grails-core MAVEN version 2.4.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-logging 2.4.0.m1 - org.grails:grails-plugin-async 2.4.0.m1 - org.grails:grails-plugin-codecs...

org.grails:grails-dependencies (2.4.0), org.grails:grails-encoder (2.4.0) +32 more potentially affected by CVE-2019-12728 via org.grails:grails-core (2.4.0)

org.grails:grails-core MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.grails:grails-core and may be impacted: - org.grails:grails-dependencies 2.4.0 - org.grails:grails-encoder 2.4.0 - org.grails:grails-logging 2.4.0 -...