gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-1176 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-1176 Source advisory: OSV:GHSA-WP72-7HJ9-5265...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-1177 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-1177 Source advisory: OSV:GHSA-XG73-94FP-G449...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-1177 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-1177 Source advisory: OSV:PYSEC-2023-29...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-1176 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-1176 Source advisory: OSV:PYSEC-2023-28...

CVE-2022-42948

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI...

CVE-2022-42948

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI...

CVE-2023-28818

An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files aptare.jar or...

Design/Logic Flaw

An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files aptare.jar or...

CVE-2022-42948

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI...

CVE-2023-28818

An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files aptare.jar or...

CVE-2022-42948: Improper Encoding or Escaping of Output

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI...

What Is Cloud Architecture?

What is cloud architecture? And what types of clouds are there? Cloud architecture defines how all the components that enable cloud computing come together...

TYPO3-EXT-SA-2023-003: Cross-Site Scripting in extension "Fluid Components" (fluid_components)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-003...

TYPO3-EXT-SA-2023-003: Cross-Site Scripting in extension "Fluid Components" (fluid_components)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-003...

Privilege Escalation

github.com/kubevirt/kubevirt is vulnerable to Privilege Escalation. A remote attacker is able to compromise a specific node and wait until system-critical components with high privileges appear on its node. A compromised node can be used to elevate privileges beyond the node, potentially having...

elice-backend-components (>=18.10.4.0, <=18.11.3.0) potentially affected by CVE-2023-28117 via sentry-sdk (0.4.3)

sentry-sdk PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - elice-backend-components =18.10.4.0, =18.11.3.0 Source cves: CVE-2023-28117 Source advisory: OSV:GHSA-29PR-6JR8-Q5JM...

Linux SMB Component Heap Buffer Overflow DoS

The vulnerability of the smb2isstatusiotimeout function in Linux kernel-based SMB components is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

GHSA-CP96-JPMQ-XRR2 On a compromised node, the virt-handler service account can be used to modify all node specs

Impact If a malicious user has taken over a Kubernetes node where virt-handler the KubeVirt node-daemon is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can for instance read all secrets on t...

Malicious code in @sok-brand-sites/common-frontend-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f4c8c64db834f3a9d141af04ecce73e9a889fadbcdb655db23b07c73e2a6145 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @sok-brand-sites/common-frontend-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...