MAL-2023-8290 Malicious code in poc-nvk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10eb10880328aea55a7c7620d283f145ebcb574bfc98567eef9ad44d1ee8fcdb The OpenSSF Package Analysis project identified 'poc-nvk' @ 0.1.2 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8289 Malicious code in nvkvictim-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4d0c415815934e3c66b707f8613100479590a1afe4a29fc46c607999157536e2 The OpenSSF Package Analysis project identified 'nvkvictim-poc' @ 0.1 pypi as malicious. It is considered malicious because: - The package...

Malicious code in @zpp/campaign-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bf91721d9ccb3de458db5333c68a7144fbf85950c53ad2ee5c0086124814a1cd The OpenSSF Package Analysis project identified '@zpp/campaign-widgets' @ 10.9.2 npm as malicious. It is considered malicious because: - The...

Malicious code in materialxview (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1b0129f95fe66ebf987bfa6a5be63ab5f66e779e9f3f2ce406d0966d43f75db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 37 Update: pmix-4.1.3-1.fc37

The Process Management Interface PMI has been used for quite some time as a means of exchanging wireup information needed for interprocess communication. Two versions PMI-1 and PMI-2 have been released as part of the MPICH effort. While PMI-2 demonstrates better scaling properties than its PMI-1...

[SECURITY] Fedora 38 Update: pmix-4.1.3-1.fc38

The Process Management Interface PMI has been used for quite some time as a means of exchanging wireup information needed for interprocess communication. Two versions PMI-1 and PMI-2 have been released as part of the MPICH effort. While PMI-2 demonstrates better scaling properties than its PMI-1...

[SECURITY] Fedora 39 Update: pmix-4.1.3-1.fc39

The Process Management Interface PMI has been used for quite some time as a means of exchanging wireup information needed for interprocess communication. Two versions PMI-1 and PMI-2 have been released as part of the MPICH effort. While PMI-2 demonstrates better scaling properties than its PMI-1...

MAL-2023-8264 Malicious code in epicgamesnavimpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c21544e84272de2c8cab4a4d6fbf98fb34810dddf1f196b2e337e84c03302d9e The OpenSSF Package Analysis project identified 'epicgamesnavimpl' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8266 Malicious code in epicgamestoggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ce8cf223ee5049675959ae63d69ac8dc4097b3ceb5b795ae832d13b85f7cea5c The OpenSSF Package Analysis project identified 'epicgamestoggle' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in @atbdigitalteam/ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2756dc0ffc0a9cddcb70299b7fc1cb3722a348f93647bf237c1f130ecb60ff02 The OpenSSF Package Analysis project identified '@atbdigitalteam/ui-widgets' @ 2.4.1 npm as malicious. It is considered malicious because: - The...

Cross site scripting

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting XSS issue when a site has content security policy CSP headers disabled. Having CSP disabled is a non-default configuration...

CVE-2023-43657

Summary: CVE-2023-43657 affects the discourse-encrypt plugin for Discourse. The issue is an improper escaping of encrypted topic titles that can lead to cross-site scripting (XSS) when CSP headers are disabled (a non-default configuration). The problem is addressed by commit 9c75810af9, included ...

CVE-2023-43657 Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configuration

discourse-encrypt is a plugin that provides a secure communication channel through Discourse. Improper escaping of encrypted topic titles could lead to a cross site scripting XSS issue when a site has content security policy CSP headers disabled. Having CSP disabled is a non-default configuration...

CLSA-2023-1695900880 Fix of 5 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-42753 - netfilter: ipset: add the missing IPSETHASHWITHNET0 macro for ipsethashnetportnet.c CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982 - init: Provide archcpufinalizeinit - x86/cpu: Switch to archcpufinalizeinit - init: Remo...

Malicious code in zenfi-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9a75914f8d0929ed48294224224fab435793f654258889e4435c268b34d2ac4c The OpenSSF Package Analysis project identified 'zenfi-sdk' @ 1.5.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in csm27878 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0055598a8a443f1bd67fa612291473dcb36ba6e1c9927df85775eea3d207de11 The OpenSSF Package Analysis project identified 'csm27878' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in csmqrcode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7be3c7341134e3f6e8c5e298589bbf69296fe3056e225eb82b91aa3d23f5898a The OpenSSF Package Analysis project identified 'csmqrcode' @ 11.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in @ltd2research/tldrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b91e4540f7f53e684e429ddaece0e59adb5e02fb0e24c2faef4200ee61771875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the application software interface of the microprogramming system for controller security and session management in IP networks, OpenScape SBC (Session Border Controller), the software tool for integrating communication systems into a unified communication system, OpenScape BCF (Business Communication Fabric), and the OpenScape Branch server allow a perpetrator to execute arbitrary PHP code.

The vulnerability of the application programming interface of microprogramming software for controlling security and managing communication sessions in IP networks, the OpenScape SBC Session Border Controller, a software tool for integrating communication systems into a unified communication...

MAL-2023-8223 Malicious code in @hnbi/searchfeuikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc2a084aa0cb1894201a316f58f41e4ec30f5b5cb2e4d0fbe2d514c544064de4 The OpenSSF Package Analysis project identified '@hnbi/searchfeuikit' @ 3.1.4 npm as malicious. It is considered malicious because: - The packag...