MAL-2024-7940 Malicious code in bs58lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66b5203201dce86ff759e5c55007837099f74ef7bd7d925ebf3c4420106f5889 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7995 Malicious code in theme-bahrain-nb-hdddc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22b870164e088eff8d02fbc7631e1a1635a1810965e38de6362e8d93dc02434d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7994 Malicious code in theme-bahrain-nb-hddd2c (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2c4d9f69a68847d94866c5c7615ea8e879f744fe989442fd0e658480480744e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-29718 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.10.0 through 4.19.1.0 Description: The issue is caused by an access permission validation problem that allows domain admin accounts to query all registered account-users API and secret keys, including those of the...

CVE-2024-7246

A flaw was found in Google gRPC due to HPACK table poisoning between the proxy and backend so that other clients see failed requests, resulting in a denial of service. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent...

DEBIAN-CVE-2024-7246

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the...

SUSE CVE-2024-42155

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or...

SUSE CVE-2024-42156

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key...

MAL-2024-7905 Malicious code in @bingads-webui-react/with-site-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 997e1cce193e872c031f1482119f4899f32d99a1ecc7dc194270a504607c421e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Django SQL注入漏洞

Django is a set of open source web application framework based on Python language from Django Foundation. The framework includes an object-oriented mapper, view system, template system, and more. An SQL injection vulnerability exists in Django versions prior to 5.0 to 5.0.8 and 4.2 to 4.2.15, whi...

MAL-2024-7887 Malicious code in dea-hallow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60d117e12ade65c2393741c7e014711e7b75200cb4ff881eb855997fc6023bb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7889 Malicious code in permenmd-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db6efdc7a6ea747eacdf9b6dbd68c824e07aa445ac5c745fe847bf13866414c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7891 Malicious code in permenmd-wifi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2574afbf5c3faac083fdab7db2254f6589a6bd17e6b42868bd5478a6a1397981 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7892 Malicious code in prmnmd-tuls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 422a0a19eabc0aeb101d13844348daed919589aa7aa3b6567c3146a5850c7678 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-33895

Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in version 21.2s10 and 22.1s3, the key is now unique per device...

CVE-2024-40719

The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it...

CVE-2024-40719

The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it...

CVE-2024-40719

CVE-2024-40719 affects CHANGING Information Technology TCBServiSign Windows Version. The issue is insufficient encryption strength of the authorization keys used by the product, enabling a remote attacker to entice a victim to visit a malicious website and cause TCBServiSign to treat that site as...

Bostr Improper Authorization vulnerability

Even with authorizedkeys is filled with allowed pubkeys, If noscraper is enabled, It will allow anyone to use bouncer even it's pubkey is not in authorizedkeys. Impact - Private bouncer Patches Available on version 3.0.10 Workarounds Disable noscraper if you have authorizedkeys being set in confi...

PT-2024-25532 · Cosy+ · Cosy+

Name of the Vulnerable Software and Affected Versions: Cosy+ devices versions 21.x below 21.2s10 Cosy+ devices versions 22.x below 22.1s3 Description: The issue concerns the use of a unique key for encrypting configuration parameters in Cosy+ devices. This key is not unique per device in affected...