Vulnerabilities fixed in IBM DB2

IBM has fixed vulnerabilities in several DB2 products such as DB2, DB2 for Cloud Pak and Web Query for i. A malicious party could exploit the exploit the vulnerabilities to grant himself locally elevated privileges assigned arbitrary code and thus execute arbitrary code with potentially privilege...

Malicious code in paytm-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17a3cc5106fdbcfdb7b5fcf3fc077142981c268b775e90e73b33fb15d200bb80 The OpenSSF Package Analysis project identified 'paytm-common-components' @ 9.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2024-32 Malicious code in paytm-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17a3cc5106fdbcfdb7b5fcf3fc077142981c268b775e90e73b33fb15d200bb80 The OpenSSF Package Analysis project identified 'paytm-common-components' @ 9.0.1 npm as malicious. It is considered malicious because: - The...

UMC software Product Management Heap Buffer Overflow DoS

The vulnerability of the UMC software product management components, including Opcenter Quality, SIMATIC PCS neo, SINUMERIK Integrate RunMyHMI/Automotive, Totally Integrated Automation Portal TIA Portal, is related to the use of an unauthorized intermediate policy file. Exploiting this...

PT-2024-18986 · View · View

Name of the Vulnerable Software and Affected Versions: view component versions prior to 3.9.0 and 2.83.0 Description: The view component framework for Ruby on Rails has a cross-site scripting issue that can impact anyone rendering a component directly from a controller with the view component gem...

Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-29827 DESCRIPTION: Node.js ejs module could allow a remote authenticated attacker t...

@darajs/components (>=1.0.0-a.1, <=1.5.1), @datalayer-jupyter/widgets (>=0.0.5, <=0.0.6) +13 more potentially affected by CVE-2023-46308 via plotly.js (>=2.0.0-rc.0, <=2.23.2)

plotly.js NPM version =2.0.0-rc.0, =1.0.0-a.1, =0.0.5, =0.0.1, =0.47.0, =0.50.3, =1.0.0, =0.0.23, =1.33.0-rc.1, =1.0.0, =1.17.1, =0.1.3, =0.23.0, =1.0.0, =1.0.5 - react-chart-editor 0.45.0-rc.0 - survey-analytics 1.9.7 Source cves: CVE-2023-46308 Source advisory: GHSA-WJC4-73Q6-GV3M...

MAL-2024-24 Malicious code in airslate-core-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c21f5962b915c0b031edeb72b4f1d9025ac43bfbbf6be787ea90cba1e1e8fedc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in airslate-core-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in mw-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab85f947099773c7e6dd5b4c3abd115db9beee7e407c87916ef282f8992ac845 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in airslate-core-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c21f5962b915c0b031edeb72b4f1d9025ac43bfbbf6be787ea90cba1e1e8fedc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in mw-common-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-50711

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

Malware in @serenity-web/components-base

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @serenity-web/components-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c85633dc6373fe7b73c4d82c80a69e7b0997938dc620a25e7c74df66cf91257 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

org.infinispan:infinispan-cachestore-remote (12.0.0.dev03), org.infinispan:infinispan-cdi-remote (12.0.0.dev03) +12 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.0.0.dev03)

org.infinispan:infinispan-client-hotrod MAVEN version 12.0.0.dev03 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.infinispan:infinispan-cachestore-remote 12.0.0.dev03 -...

org.infinispan:infinispan-cachestore-remote (12.0.0.cr1), org.infinispan:infinispan-cdi-remote (12.0.0.cr1) +12 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.0.0.cr1)

org.infinispan:infinispan-client-hotrod MAVEN version 12.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.infinispan:infinispan-cachestore-remote 12.0.0.cr1 -...

org.infinispan:infinispan-cachestore-remote (12.1.0.cr2), org.infinispan:infinispan-cdi-remote (12.1.0.cr2) +12 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.1.0.cr2)

org.infinispan:infinispan-client-hotrod MAVEN version 12.1.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.infinispan:infinispan-cachestore-remote 12.1.0.cr2 -...

org.infinispan:infinispan-cachestore-remote (12.1.13.final), org.infinispan:infinispan-cdi-remote (12.1.13.final) +13 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.1.13.final)

org.infinispan:infinispan-client-hotrod MAVEN version 12.1.13.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.infinispan:infinispan-cachestore-remote 12.1.13.final -...

CLSA-2023-1703611617 Fix CVE(s): CVE-2023-45539

SECURITY UPDATE: Accepting '' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact - debian/patches/CVE-2023-45539.patch: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header -...