MAL-2024-1104 Malicious code in lyft-exceptions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5e0290aaa0cb90a501cb0a0b357f32d3e725f6f3a97541cbc2796671ea4e8f60 The OpenSSF Package Analysis project identified 'lyft-exceptions' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2024-1100 Malicious code in ouramerica-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5e8ad6206cb55fdcb549168be1855e019bdc7745420d9b12074c0d682e66d50 The OpenSSF Package Analysis project identified 'ouramerica-constants' @ 1.0.0 npm as malicious. It is considered malicious because: - The packa...

Uncontrolled Resource Consumption ('Resource Exhaustion')

Overview Affected versions of this package are vulnerable to Uncontrolled Resource Consumption 'Resource Exhaustion' due to the handling of connections in NetFraming based services. An attacker can consume extra system resources by establishing connections that are not properly closed or aborted...

Malicious code in soundcloud-scrape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49aa7d872acd9b91dd62d1aec545292c8d638126b53eadcc46435726c1c4215a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frosmo-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49ad426e0403cbb83406507bc9ee1c54e3c62183174858cd77bd8d4f0d52cbd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CoreWCF Security Vulnerabilities

CoreWCF is an open source project of the CoreWCF project that aims to provide an alternative implementation of WCF Windows Communication Foundation for .NET Core and .NET 5+. A security vulnerability exists in CoreWCF versions 1.4.1 and 1.5.1, which stems from the fact that a service based on...

Cross site scripting

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets o...

Design/Logic Flaw

Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to out-of-bound read/writes to SMRAM...

CVE-2024-0162

Dell PowerEdge Server BIOS and Dell Precision Rack BIOS are affected by an Improper SMM communication buffer verification vulnerability that enables out-of-bounds reads/writes to SMRAM via a local, low-privilege attacker. Affected components are the BIOS implementations for Dell PowerEdge Server ...

CVE-2024-0162

Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to out-of-bound read/writes to SMRAM...

CVE-2024-0161

Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM...

CVE-2024-0161

Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM...

Malicious code in sdge-it-tdg-dynamicloadprofiles-sempra-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d7a435ca75f0214af0cf902eeb6293bba2778f04c71cc5afd45ac109c0a78c5 The OpenSSF Package Analysis project identified 'sdge-it-tdg-dynamicloadprofiles-sempra-poc' @ 2.0.2 npm as malicious. It is considered maliciou...

MAL-2024-1093 Malicious code in sdge-it-tdg-dynamicloadprofiles-sempra-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d7a435ca75f0214af0cf902eeb6293bba2778f04c71cc5afd45ac109c0a78c5 The OpenSSF Package Analysis project identified 'sdge-it-tdg-dynamicloadprofiles-sempra-poc' @ 2.0.2 npm as malicious. It is considered maliciou...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Buffer Overflow Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Out-of-Bounds Read Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Stack Buffer Overflow Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

CVE-2024-22039

A vulnerability has been identified in Cerberus PRO EN Engineering Tool All versions IP8, Cerberus PRO EN Fire Panel FC72x IP6 All versions IP6 SR3, Cerberus PRO EN Fire Panel FC72x IP7 All versions IP7 SR5, Cerberus PRO EN X200 Cloud Distribution IP7 All versions V3.0.6602, Cerberus PRO EN X200...

CVE-2024-22041

CVE-2024-22041 pertains to the network communication library in Siemens Cerberus PRO EN and Sinteso/Sinteso Mobile/product ecosystems, which improperly handles memory buffers when parsing X.509 certificates. This leads to an unauthenticated remote attacker potentially crashing the affected networ...

CVE-2024-22040

Siemens CVE-2024-22040 involves a buffer overread in the network communication library due to insufficient validation of HMAC values. The flaw can allow an unauthenticated remote attacker to crash the affected network service. Affected products span Cerberus PRO EN Engineering Tool, Cerberus PRO ...