@aklesky/vite-config (>=0.7.9, <=0.9.0), @angular-devkit/build-angular (>=17.1.0-next.0, <=17.1.0) +91 more potentially affected by CVE-2024-23331 via vite (>=5.0.0, <=5.0.11)

vite NPM version =5.0.0, =0.7.9, =17.1.0-next.0, =1.0.25-beta.0, =0.5.0, =0.22.0, =1.0.0-rc.12, =4.20.4, =1.0.0-dev.74fcb60, =1.0.274, =0.40.2, =0.0.7, =0.0.1, =11.12.0-beta.0, =11.13.0 and more Source cves: CVE-2024-23331 Source advisory: OSV:GHSA-C24V-8RFC-W8VW...

@amitojsingh366/pioneer-react (>=0.0.3, <=0.0.4), @angular-devkit/build-angular (>=17.0.0-rc.0, <=17.0.5) +51 more potentially affected by CVE-2023-49293 via vite (4.5.0)

vite NPM version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on vite and may be impacted: - @amitojsingh366/pioneer-react =0.0.3, =17.0.0-rc.0, =0.20.0, =1.0.0-rc.5, =0.5.4, =0.1.0, =17.0.0-next.11, =17.0.0-next.11, =0.0.0, =0.2.0,...

SUSE CVE-2023-46122

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorizedkeys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however...

Code injection

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorizedkeys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however...

CVE-2023-46122

CVE-2023-46122 affects sbt’s IO.unzip and can enable arbitrary file writes when extracting a crafted zip/JAR, with potential to overwrite the root SSH authorized_keys. Within sbt, IO.unzip is used in pullRemoteCache and Resolvers.remote, and many projects call IO.unzip directly. Root cause: archi...

CVE-2023-42445

CVE-2023-42445 affects Gradle: XML External Entity (XXE) resolution was not disabled in some parsing paths, enabling potential exfiltration of local text files via XML parsing with an OOB-XXE scenario. Documents confirm Gradle now disables XML external entities for all use cases in Gradle 7.6.3 a...

CVE-2023-44387

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to...

CVE-2023-44387

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to...

ALSA-2023:4635 Important: rust-toolset:rhel8 security update

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. Security Fixes: rust-cargo: cargo does not respect the umask when extracting dependencies CVE-2023-38497 For more details about the security issues, including t...

AZL-37347 CVE-2023-29405 affecting package golang for versions less than 1.21.6-1

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. Flags containing...

@akrc/vidocs (>=0.0.0, <=0.0.2), @alexzzz/npms (>=0.0.5, <=0.2.0) +114 more potentially affected by CVE-2023-34092 via vite (>=3.0.2, <=3.2.5)

vite NPM version =3.0.2, =0.0.0, =0.0.5, =1.0.1, =1.0.1, =3.2.0, =0.0.37, =0.0.35, =0.2.3, =0.0.0-canary-20220914153453, =0.0.6, =0.1.0, =0.0.3, =6.24.0, =0.1.1, =0.1.23 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@aem-vite/import-rewriter (>=5.0.1, <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0-alpha.1, <=2.3.1) +210 more potentially affected by CVE-2023-34092 via vite (>=2.0.0-beta.4, <=2.9.15)

vite NPM version =2.0.0-beta.4, =5.0.1, =1.0.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.2, =0.9.1, =1.0.16, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.16 and more Source cves: CVE-2023-34092 Source advisory...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +46 more potentially affected by CVE-2023-34092 via vite (>=4.1.0, <=4.1.4)

vite NPM version =4.1.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.0-canary-20230215113341, =4.6.2, =11.6.5, =5.3.8, =5.0.0, =5.0.1 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@alioth_91/alita (>=3.3.9-patch.1, <=3.3.9-patch.2), @alitajs/vue-i18n (>=0.0.7, <=0.0.8) +98 more potentially affected by CVE-2023-34092 via vite (>=4.3.0, <=4.3.8)

vite NPM version =4.3.0, =3.3.9-patch.1, =0.0.7, =0.0.7, =0.0.7, =0.0.7, =0.0.7, =0.0.1-canary.0, =0.0.1-canary.0, =16.0.0-rc.2, =2.0.0-bate-1, =12.0.0, =0.0.0-canary-20230426131112, =0.0.1, =0.0.12 - @deconz-community/directus-extension-ddf-store 0.1.0 and more Source cves: CVE-2023-34092 Source...

Default configuration

Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets...

CVE-2023-30853

CVE-2023-30853 describes an information disclosure in the Gradle Build Action for GitHub Actions when the configuration cache is enabled in versions prior to 2.4.2. Environment variables passed to Gradle can be persisted into GitHub Actions cache entries, which may be read by untrusted workflows ...

CVE-2023-30853 Gradle Build Action data written to GitHub Actions Cache may expose secrets

Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets...

PT-2023-23009 · Gradle +1 · Gradle Build Tool +1

Name of the Vulnerable Software and Affected Versions: Gradle Build Action versions prior to 2.4.2 Description: A vulnerability in the Gradle Build Action impacts GitHub workflows that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets configure...

@pzlr/build-core (>=2.14.0, <=2.15.1), @v4fire/cli (>=1.3.0, <=2.1.0) +3 more potentially affected by CVE-2023-26113 via collection.js (6.7.11)

collection.js NPM version 6.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on collection.js and may be impacted: - @pzlr/build-core =2.14.0, =1.3.0, =2.0.0-beta.1, =2.0.0-beta.1, =3.75.0 Source cves: CVE-2023-26113 Source advisory:...

@acanto/laravel-scripts (>=0.2.14, <=0.2.27), @adobe/helix-deploy (>=1.6.0, <=7.3.1) +1261 more potentially affected by CVE-2023-28154 via webpack (>=5.0.0, <=5.75.0)

webpack NPM version =5.0.0, =0.2.14, =1.6.0, =3.0.0, =1.0.44, =3.0.0-beta.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.17-beta.7, =0.2.0, =0.0.0-dev-4fb73016-20210914-1634176750976, =0.1.5 - @akphi/dev-utils1 0.0.1 and more Source cves:...