Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles

Impact The 1.4.0 release includes a regression on the filesystem scope check for dotfiles on Linux and macOS. Previously dotfiles eg. $HOME/.ssh/ were not implicitly allowed by the glob wildcard scopes eg. $HOME/, but a regression was introduced when a configuration option for this behavior was...

GHSA-C2QF-RXJJ-QQGW vulnerabilities

Vulnerabilities for packages: arangodb...

MAL-2023-107 Malicious code in assets-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e513e7556846ca62fa4d27646eef928d55f2c2954ce9caa51dd63643e2adf445 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

GHSA-6MJQ-H674-J845 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, cloudwatch-exporter...

GHSA-6MJQ-H674-J845 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, cloudwatch-exporter...

MAL-2023-153 Malicious code in cache-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 967892bb014a13ae52c15c89a3f5ebbdc8e841bf2fd8dbe6502400f91357503d Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-697 Malicious code in price-record (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3b87630cf8eb8594e67451df7fae7627d35da7c1f67a44b1751201766dbe54a0 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-755 Malicious code in sample-app-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a7432b767dd8bf532a686b3a40add828170682af3dcfdcab09c7d7a012a83e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-GQ98-53RQ-QR5H vulnerabilities

Vulnerabilities for packages: k3d...

GHSA-XHG5-42RF-296R vulnerabilities

Vulnerabilities for packages: zot...

GHSA-C57C-7HRJ-6Q6V vulnerabilities

Vulnerabilities for packages: k3d...

GHSA-5CPQ-8WJ7-HF2V vulnerabilities

Vulnerabilities for packages: conda, mitmproxy, py3-cassandra-medusa...

Malicious code in firtssocketia2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c353cdf21295452aa2f8e354ed809efa2c6de59ae16de599dd2c41dc554e0954 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-32307

Sofia-SIP (SIP UAs) has CVE-2023-32307 describing multiple vulnerabilities in STUN packet handling, including heap overflow and OOB read caused by missing attributes length checks. Attacks could crash or cause high memory usage; these issues were addressed in version 1.13.15, with upgrades advise...

Fedora 37 : python-starlette (2023-b082504356)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b082504356 advisory. Backport patch for GHSA-v5gw-mw7f-84px Path traversal vulnerability in StaticFiles. Tenable has extracted the preceding description block directly from the...

GHSA-J8R2-6X86-Q33Q vulnerabilities

Vulnerabilities for packages: k8s-sidecar...

XWiki 1.2-milestone-1 < 13.10.11, 14.x < 14.4.7, 14.5.x < 14.10 Information Disclosure Vulnerability (GHSA-4f8g-fq6x-jqrr)

Xwiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

XWiki 1.9-milestone-2 < 13.10.10, 14.x < 14.4.6, 14.5.x < 14.9 XSS Vulnerability (GHSA-6vgh-9r3c-2cxp)

Xwiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

Duplicate Advisory: PrestaShop Cross-site Scripting vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95hx-62rh-gg96. This link is maintained to preserve external references. Original Description A cross-site scripting XSS vulnerability in PrestaShop v1.7.7.4 allows attackers to execute arbitrary web scripts or...

MAL-2023-698 Malicious code in prisoners-of-geography-ten-maps-that-explain-everything-about-the-world-by-tim-marshall-on-iphone-fu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 154bcf7ce0ea7f54cfa32c942d23572613f0e0e707ad9bd85721e498412fa445 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...