MAL-2024-1331 Malicious code in roblox.lua (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e40a28a758bd57252f74153dd5b2a9b6358608bfa2ec08c301e3647a7721e35a The OpenSSF Package Analysis project identified 'roblox.lua' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Ruijie Networks RG-UAC 安全漏洞

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. A security vulnerability exists in Ruijie Networks RG-UAC 20240428 and earlier versions, which stems from the parameter...

MAL-2024-1323 Malicious code in @socialdeal/uikit-whitelabel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d53c0749d21786a6b7eeea319c37d26573f1ded671dc9cbed9e4508d9b65a2c0 The OpenSSF Package Analysis project identified '@socialdeal/uikit-whitelabel' @ 999.100.1 npm as malicious. It is considered malicious because:...

MAL-2024-1330 Malicious code in elk-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aaece47ca73a2646b0cb728b7816026ec3135f48e18054950dce89f8bf9073b0 The OpenSSF Package Analysis project identified 'elk-uikit' @ 99.99.1 npm as malicious. It is considered malicious because: - The package execut...

Medium: gnutls

Issue Overview: A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeab...

CVE-2024-27069

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

CVE-2024-27069

CVE-2024-27069 affects the Linux kernel overlayfs ovl_verify_area path. The issue was a WARN_ON assertion triggered by syzbot’s copy-up loop when a lower file’s size changes underneath overlayfs. The documented fix relaxes the WARN_ON in ovl_verify_area and aligns error handling (returning EIO fo...

CVE-2024-27069

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

CVE-2024-26963 usb: dwc3-am62: fix module unload/reload behavior

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-am62: fix module unload/reload behavior As runtime PM is enabled, the module can be runtime suspended when .remove is called. Do a pmruntimegetsync to make sure module is active before doing any register operations. Doi...

CVE-2024-27069: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

webkitgtk: A malicious website may cause unexpected cross-origin behavior

A flaw was found in WebKit. This flaw allows a remote attacker to trigger unexpected cross-origin behavior via a malicious website...

MAL-2024-1308 Malicious code in not-exist-lykos-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a4ae62646ef95a3157dcd61e8c0f58a25bec2c826d45f514c6e7bffde0126d4 The OpenSSF Package Analysis project identified 'not-exist-lykos-poc' @ 66.6.6 npm as malicious. It is considered malicious because: - The packa...

vyper performs incorrect topic logging in raw_log

Summary Incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. In particular, no uses of rawlog were found at all in production; it is apparently not ...

CLSA-2024-1714065005 Fix of 9 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-1998 - x86/speculation: Allow enabling STIBP with legacy IBRS CVE-url: https://ubuntu.com/security/CVE-2021-47193 - scsi: pm80xx: Tie the interrupt name to the module instance - scsi: pm80xx: Deal with kexec reboots - scsi: pm80xx: Increase number of...

Vyper 安全漏洞

Vyper is the Pythonic smart contract language for EVM. A security vulnerability exists in Vyper versions 0.3.10 and earlier, which stems from incorrect logging of topics in rawlog, and could lead to unexpected behavior in client applications that rely on these logs...

CVE-2024-23271

A logic issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, Safari 17.3, tvOS 17.3, macOS Sonoma 14.3, watchOS 10.3. A malicious website may cause unexpected cross-origin behavior...

DEBIAN-CVE-2024-23271

A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A malicious website may cause unexpected cross-origin behavior...

CVE-2024-23271

A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A malicious website may cause unexpected cross-origin behavior...

CVE-2024-23271

A logic issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A malicious website may cause unexpected cross-origin behavior...

CVE-2024-23271

A logic issue in the WebKit rendering engine was addressed with improved checks to prevent unexpected cross-origin behavior . This vulnerability affects Safari 17.3 , iOS 17.3 , iPadOS 17.3 , macOS Sonoma 14.3 , tvOS 17.3 , and watchOS 10.3 . Impacted systems using the webkitgtk4 package, such as...