UBUNTU-CVE-2025-22233

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: 6.2...

Spring Framework DataBinder Case Sensitive Match Exception (2nd update)

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks...

Moment.js: Path traversal in moment.locale

A path traversal vulnerability was found in Moment.js that impacts npm server users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity...

Moment.js: Path traversal in moment.locale

A path traversal vulnerability was found in Moment.js that impacts npm server users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity...

[SECURITY] Fedora 41 Update: rust-icu_locid_transform-1.5.0-1.fc41

API for Unicode Language and Locale Identifiers canonicalization...

[SECURITY] Fedora 41 Update: rust-icu_locid-1.5.0-2.fc41

API for managing Unicode Language and Locale Identifiers...

[SECURITY] Fedora 40 Update: rust-icu_locid-1.5.0-2.fc40

API for managing Unicode Language and Locale Identifiers...

[SECURITY] Fedora 42 Update: rust-icu_locid-1.5.0-2.fc42

API for managing Unicode Language and Locale Identifiers...

[SECURITY] Fedora 42 Update: rust-icu_locid_transform-1.5.0-1.fc42

API for Unicode Language and Locale Identifiers canonicalization...

Malware in element-ui-locale-en

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in element-ui-locale-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5fceb0684e44fef543d79d4744dc2a8e652e74219d8ef07c317f2d3f1c40dc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in element-ui-locale-en (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65cfe05538769df2b22ed9c915a7d41c57874cd3671f5d9b9da0a63d201df3eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in element-ui-locale-id

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3217 Malicious code in element-ui-locale-en (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65cfe05538769df2b22ed9c915a7d41c57874cd3671f5d9b9da0a63d201df3eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3218 Malicious code in element-ui-locale-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5fceb0684e44fef543d79d4744dc2a8e652e74219d8ef07c317f2d3f1c40dc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the endpoints listed below. An attacker can manipulate user data or configuration settings, and perform unauthorized actions by convincing users to follow malicious links that execute unintended...

Security Bulletin: The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly affects watsonx.data

Summary The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in authorization rules not working properly. Hense could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-38827 DESCRIPTION: The usage of String.toLowerCase a...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: CVE-2024-44192: Fixed unexpected process crash due to processing maliciously crafted web content bsc1239863 CVE-2024-54467: Fixed information disclosure via data cross-origin exfiltration due to a cookie management issue bsc1239864 Other...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: CVE-2024-44192: Fixed unexpected process crash due to processing maliciously crafted web content bsc1239863 CVE-2024-54467: Fixed data exilfration cross-origin due to a cookie management issue via a malicious website bsc1239864 Other fixes: ...

Babel Locale Code Execution

The vulnerability of the Babel.Locale function in the library for helping with internationalization and localization of Python applications is related to an incorrect restriction on the path to a limited directory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...