Malicious code in @expressions/excel-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f285f6202227757b1ae10391ea069ae841e5b19a58529e5ce7b0f0a37e48c91 The OpenSSF Package Analysis project identified '@expressions/excel-functions' @ 3.0.0 npm as malicious. It is considered malicious because: - T...

MAL-2023-1079 Malicious code in @expressions/excel-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f285f6202227757b1ae10391ea069ae841e5b19a58529e5ce7b0f0a37e48c91 The OpenSSF Package Analysis project identified '@expressions/excel-functions' @ 3.0.0 npm as malicious. It is considered malicious because: - T...

jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin

A flaw was found in the Jenkins JUnit plugin. The affected versions of the JUnit Plugin do not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting XSS vulnerability. This may allow an attacker to control test case class names in the JUnit resources...

CVE-2023-22665 Apache Jena: Exposure of arbitrary execution in script engine expressions.

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query...

How to control IP address returned in a DNS query based on source IP address (local DNS IP address)

This article contains information about how to control IP address returned in a DNS query based on source IP address local DNS IP address The IP addresses DNS returned must work inactive/standby mode. Also, you can use DNS policy expressions to monitor load balancing service statusassociate to th...

PYSEC-2023-87

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. This issue was introduced by commit e75e358. The vulnerability may lead to Denial of Service DoS. This...

PT-2023-4884

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.2.24 Spring Framework versions prior to 5.3.27 Spring Framework versions prior to 6.0.8 Description The issue is related to errors in processing SpEL expressions. It is possible for a user to provide a...

CVE-2023-20863

In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service DoS condition...

Spring Framework 安全漏洞

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A security vulnerability exists in Spring Framework that originates from a denial of service DoS by supplying a specially crafted Sp...

NewStart CGSL CORE 5.05 / MAIN 5.05 : python-pillow Multiple Vulnerabilities (NS-SA-2023-0015)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python-pillow packages installed that are affected by multiple vulnerabilities: - pathgetbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. CVE-2022-22816 -...

Angular 安全漏洞

Angular is a development platform. It is used to build mobile and desktop web applications using Typescript / JavaScript and other languages. Angular has a security vulnerability that stems from the use of insecure regular expressions that are susceptible to Regular Expression Denial of Service...

Angular 安全漏洞

Angular is a development platform. It is used to build mobile and desktop web applications using Typescript / JavaScript and other languages. Angular has a security vulnerability that stems from the use of insecure regular expressions that are susceptible to Regular Expression Denial of Service...

Trojanized TOR Browser Installers Spreading Crypto-Stealing Clipper Malware

Trojanized installers for the TOR anonymity browser are being used to target users in Russia and Eastern Europe with clipper malware designed to siphon cryptocurrencies since September 2022. "Clipboard injectors ... can be silent for years, show no network activity or any other signs of presence...

Medium: pcre2

Issue Overview: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the pcre2jitcompile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not full...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2023-057)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-057 advisory. A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths, leading to a buffer over-read and improper initialization. This flaw allows an attacke...

Amazon Linux 2023 : pcre2, pcre2-devel, pcre2-static (ALAS2023-2023-045)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-045 advisory. An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the pcre2jitcompile.c file. This involves a unicode property matching issue ...

Spring Expression DoS Vulnerability

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service DoS condition...

USN-5944-1: SnakeYAML vulnerabilities

It was discovered that SnakeYAML did not limit the maximal nested depth for collections when parsing YAML data. If a user or automated system were tricked into opening a specially crafted YAML file, an attacker could possibly use this issue to cause applications using SnakeYAML to crash, resultin...

USN-5910-1: Rack vulnerabilities

It was discovered that Rack did not properly structure regular expressions in some of its parsing components, which could result in uncontrolled resource consumption if an application using Rack received specially crafted input. A remote attacker could possibly use this issue to cause a denial of...

USN-5910-1 ruby-rack vulnerabilities

It was discovered that Rack did not properly structure regular expressions in some of its parsing components, which could result in uncontrolled resource consumption if an application using Rack received specially crafted input. A remote attacker could possibly use this issue to cause a denial of...