Use Of Uninitialized Variable

github.com/golang-fips/openssl is vulnerable to Use of Uninitialized Variable. The vulnerability is due to improper handling of uninitialized buffer lengths in FIPS mode, which can result in zeroed buffers being returned. This flaw allows an attacker to force false positive hash matches, send...

CVE-2024-9435

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL keys in all versions up to, and including, 4.9.66 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

SUSE CVE-2024-31228

Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST and ACL definitions. Matching of extremel...

CVE-2024-41592

DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs...

golang-fips: Golang FIPS zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

golang-fips: Golang FIPS zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

MAL-2024-9075 Malicious code in cookie_info (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f3a1b3ca5e526deb6d9a3b3dcb7b1282b006b8b1cf445c9c1b824162b719d26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2024:3507-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3507-1 advisory. - Mozilla Thunderbird 128.2.3 MFSA 2024-43 bsc1229821 CVE-2024-8394: Crash when aborting...

CVE-2024-9355

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

CVE-2024-9355

CVE-2024-9355 is reported in the provided CVE entry as affecting Golang FIPS OpenSSL used in MiracleLinux advisories. The connected Nessus entries (MIRACLE_LINUX_AXSA-2024-8888.NASL, MIRACLE_LINUX_AXSA-2024-9021.NASL, MIRACLE_LINUX_AXSA-2024-8957.NASL, MIRACLE_LINUX_AXSA-2024-8885.NASL, and other...

New PyPI Malware Poses as Crypto Wallet Tools to Steal Private Keys

Checkmarx researchers discovered PyPI malware posing as crypto wallet tools. These malicious packages stole private keys and recovery…...

Improper Access Control

github.com/google/exposure-notifications-server is vulnerable to Improper Access Control. The vulnerability is due to the service incorrectly assuming that the source server had properly embargoed keys for at least 2 hours after their expiry, which could allow expired keys to be re-published and...

MAL-2024-9061 Malicious code in steampipe-reports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da60e6d3d0eabe3a13ee33ff083b62e33e8c5dd6a42852a73061c0ce975fa140 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9059 Malicious code in document-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb99caad7a94acc80fdf591c1a9085e6ffcca64b8142700fe45c1e647fed2c93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9052 Malicious code in express-dompurify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91e7d551e697c3ae72eea274492e2bb8c59b0a5fabfff62717660304264ceae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9051 Malicious code in bcryptutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63ad071b1cfbbdaa4ad540f907d83bc254c10462b2a250e615822b48ee3ef1ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9355

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

cloud-init bug fix and enhancement update

An update is available for cloud-init. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The cloud-init packages provide a set of init scripts for cloud instances...

CVE-2024-6394

A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the servejs function in app.py, which allows attackers to perform path traversal attacks. This can lead to unauthorized access to arbitrary files ...