CBL Mariner 2.0 Security Update: cloud-hypervisor-cvm / edk2 / hvloader / nodejs / nodejs18 / openssl (CVE-2024-4603)

The version of cloud-hypervisor-cvm / edk2 / hvloader / nodejs / nodejs18 / openssl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4603 advisory. - Issue summary: Checking excessively long DSA ke...

python-pymysql: SQL injection if used with untrusted JSON input

A flaw was found in PyMySQL. When processing untrusted JSON input, keys are not escaped by the escapedict function due to insufficient input sanitization, allowing an attacker to inject malicious SQL queries...

CVE-2024-23737

Cross Site Request Forgery CSRF vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email...

GHSA-J59V-VGCR-HXVF GeoServer's Server Status shows sensitive environmental variables and Java properties

GeoServer's Server Status page and REST API at /geoserver/rest/about/status lists all environment variables and Java properties to any GeoServer user with administrative rights as part of those modules' status message. These variables/properties can also contain sensitive information, such as...

CVE-2024-34696 GeoServer's Server Status shows sensitive environmental variables and Java properties

GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative...

BIT-HUBBLE-UI-BACKEND-2024-28860

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key...

BIT-CILIUM-PROXY-2024-28860

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key...

MAL-2024-7064 Malicious code in puredocx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2043c68b9e064d9802a7704f5f3429aae0fe87fd4d8f5cfbd9053e21b59036c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7063 Malicious code in djs14-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af9329c7c1624c544e7762bb63fe25c7bbbb849bf3e0f38e8793138140d1d9ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7062 Malicious code in check-credit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eeaf8d20bbaa95c39cf1458d9aa8469006eee9ab9ef2202bdaf1757873c80468 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7066 Malicious code in viona-atm-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e4f8f45815fbf187f1a9029ae5a5a432aa518eab883ecec21dbed96d6eecac3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from an information...

Savignano Software Solutions S/Notify Security Breach

Savignano Software Solutions S/Notify is an email encryption program from Savignano Software Solutions, Germany. A security vulnerability previously existed in Savignano Software Solutions S/Notify version 4.0.2. An attacker exploited the vulnerability to manipulate a user's PGP key S/MIME...

Medium: python-jinja2

Issue Overview: Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application...

Excessive time spent checking DH keys and parameters

...

USN-6851-2 netplan.io regression

USN-6851-1 fixed vulnerabilities in Netplan. The update lead to the discovery of a regression in netplan which caused systemctl enable to fail on systems where systemd is not running. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Andreas Hasenack...

GO-2024-2499 Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio

Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalation in github.com/minio/minio...

MAL-2024-7051 Malicious code in @rfv/modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54928ac42ea161e8755f8a229b9b544f2da2b72cb2492e0f83b8ebe678a8f819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7053 Malicious code in colors-names (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e5c6b5ad54ce114c6a70ad40e75b6bcb8972eba01e9551c195ed7e38f3c9f23 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-37282

CVE-2024-37282 affects Elastic Cloud Enterprise (ECE) where, under certain preconditions, an API key created with limited privileges could be used to create new API keys with elevated privileges. Affected versions are ECE after 3.0.0 and before 3.7.2. The mitigation is to upgrade to version 3.7.2...