CVE-2024-56128

CVE-2024-56128 affects Apache Kafka SCRAM authentication. Root cause: SCRAM server nonce verification against the server’s first message was not performed per RFC 5802, enabling plaintext-snooping scenarios if SCRAM is used over non-TLS. Impact: exploitation requires access to plaintext SCRAM exc...

CVE-2024-4995

Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0...

CVE-2024-4995 Protocol Downgrade in Wapro ERP Desktop

Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0...

CVE-2024-4995

CVE-2024-4995 (Wapro ERP Desktop) is publicly described as a server-side MS SQL protocol downgrade vulnerability affecting Wapro ERP Desktop before 9.00.0. The issue enables unencrypted communication between components, which may allow data interception and modification. Public records do not spe...

CVE-2024-4995 Protocol Downgrade in Wapro ERP Desktop

Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0...

MAL-2024-11913 Malicious code in hardhat-deploy-others (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 85a3b67882ce27c0db4858f9509396a2a74b670426897002d8ccc9d29537c008 The OpenSSF Package Analysis project identified 'hardhat-deploy-others' @ 9.9.10 npm as malicious. It is considered malicious because: - The...

MAL-2024-11912 Malicious code in focal-examples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a810e0097be46a2d0ef76ac3c6aa2088c3467e69485c408f22014bc66dd07530 The OpenSSF Package Analysis project identified 'focal-examples' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11914 Malicious code in orderly.network (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14d606d970811240b8c005b7dc9ac5ee50ff9d2d77e9a14a34703c115392b1a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Upcoming changes for Citrix DaaS to remote hypervisor communication

Citrix DaaS service is migrating the communication channel used to access some Hypervisors. This migration will result in a more stable and higher performing connection. This transition will be performed on a rolling basis starting in Q1 2025...

MAL-2024-11899 Malicious code in anargha-manu2324 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5d8b88223767d58cf126c0232a9c2106316053505e2b4d4fdefe17848c1b3561 The OpenSSF Package Analysis project identified 'anargha-manu2324' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-49819

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors...

MAL-2024-11897 Malicious code in yir-image-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6cf1af517e2c58b4cae223cb5d746eed91636fca7b9843a427577a641e12a0f7 The OpenSSF Package Analysis project identified 'yir-image-gen' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-49819 IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors...

MAL-2024-11895 Malicious code in pai-web-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8b6dc3e380e435ff7d74a44ec8841c1577a1bd74c03ef3dc368e2514e485d8fc The OpenSSF Package Analysis project identified 'pai-web-components' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

Malicious code in @monkey-tilt/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8ac39833535be0553f3d6a87a64286940b30b0fc55a5e1c80c907518b10053b8 The OpenSSF Package Analysis project identified '@monkey-tilt/ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

PT-2024-36621 · Dtex · Dtex Dec-M

Name of the Vulnerable Software and Affected Versions: DTEX DEC-M DTEX Forwarder version 6.1.1 Description: An issue was discovered in the com.dtexsystems.helper service, which handles privileged operations within the macOS DTEX Event Forwarder agent. The service fails to implement critical clien...

PT-2025-32136

Name of the Vulnerable Software and Affected Versions Powerline Communication Firmware affected versions not specified Description A memory corruption issue exists when processing specific files. Recommendations At the moment, there is no information about a newer version that contains a fix for...

Malicious code in start-decent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74681df6bc6b8b3247624569b8632e201a6fac47376cc8561d59fccc697d83ab The OpenSSF Package Analysis project identified 'start-decent' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in pokedex-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 23c03b4e03986cba75894fb0016bc2e1feb0c72ef2c06287030498b8f7a48ea1 The OpenSSF Package Analysis project identified 'pokedex-vue3' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-10972

Velocidex WinPmem (versions 4.1 and earlier) suffers from an Improper Input Validation vulnerability. The root cause is verification only at the start of a routine, enabling a userspace process with admin privileges to change memory page permissions mid-execution, potentially triggering a BSOD vi...