Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...

GHSA-QMC2-JPR5-7RG9 Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Impact A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an attacker to capture privileged git tokens used by the Backstage Scaffolder plugin. With these...

kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider

A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider...

MAL-2024-11166 Malicious code in eslint-config-sunset-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 042f734df520ee49c1cf44e40629e136159746964c87533d226f02be765e956e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983

The CVE concerns Backstage Scaffolder template handling where Server-Side Template Injection (SSTI) can be abused to inject Git config and capture privileged Git tokens used by the Backstage Scaffolder plugin. This enables unauthorized access to Git resources, with a medium impact per the Backsta...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

MAL-2024-11099 Malicious code in spid-gc-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad2d0454e042159c3e89571e4e8154f79b74c2c9e8f588592a42ffb54b87dc69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spid-gc-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad2d0454e042159c3e89571e4e8154f79b74c2c9e8f588592a42ffb54b87dc69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spid-growth-notifier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cda56c0e08a98c9eabbe82bae2f3b70c122216d4ba4c53b799179a04061beedd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11100 Malicious code in spid-growth-notifier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cda56c0e08a98c9eabbe82bae2f3b70c122216d4ba4c53b799179a04061beedd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10967 Malicious code in eslint-config-sipp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1f1e27faa94fcff62c76c43b6e961bc217d686d8008e3dae4c6d9e0f89a6318 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10968 Malicious code in eslint-config-sipplint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dcab293e5042ecbd0641a691c76d81aaf28e34d1355556e39caa8594a6ab9e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-config-loan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86fed95ad3b55d8489ab32dd4ca52c717780e5c1e8610e7cbbe76981e9581fab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-config-sipp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1f1e27faa94fcff62c76c43b6e961bc217d686d8008e3dae4c6d9e0f89a6318 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10963 Malicious code in eslint-config-loan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86fed95ad3b55d8489ab32dd4ca52c717780e5c1e8610e7cbbe76981e9581fab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fuji Electric Monitouch V-SFT 安全漏洞

Fuji Electric Monitouch V-SFT is a human-machine interface HMI configuration software developed by Fuji Electric, which is mainly used in industrial automation, providing touch screen interface design, PDF document viewing, video playback, alarm messages and other functions. Fuji Electric Monitou...

CVE-2023-0163 Prototype Pollution in convict

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have incompatible type, which may lead to a...

CVE-2024-50373

CVE-2024-50373 affects Advantech EKI-6333AC-2G (≤1.6.3), EKI-6333AC-2GD (≤1.6.3) and EKI-6333AC-1GPO (≤1.2.1). The root cause is improper neutralization of special elements in OS commands during the restore_config_from_utility operation in the edgserver service, enabling remote unauthenticated at...