CVE-2018-16262

The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations. Such actions include installing, decrypting, and killing other packages. This affects Tizen before 5.0 M1, and Tizen-based firmwares...

CVE-2018-16262

The CVE-2018-16262 issue affects Tizen’s pkgmgr system service where an unprivileged process can perform package management actions due to improper D-Bus security policy configurations. This can enable installing, decrypting, or killing other packages. Affected platforms include Tizen up to 5.0 M...

[SECURITY] Fedora 30 Update: python-pip-19.0.3-6.fc30

pip is a package management system used to install and manage software pack ages written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python"...

Fedora Update for python-pip FEDORA-2020-6148c44137

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: python-pip-19.1.1-7.fc31

pip is a package management system used to install and manage software pack ages written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python"...

The vulnerability in the program for installing, updating, and removing software packages from the Astra Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the program for installing, updating, and removing software packages in the Astra Linux operating system is related to the correction of the update delay of packages. Exploiting this vulnerability can allow an attacker to cause service failures...

Fedora Update for openqa FEDORA-2019-c404576415

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2019:1667-1 Recommended update for evince

This update for evince provides the following fixes: Security issue fixed: - CVE-2019-11459: Fixed an improper error handling in which could have led to use of unitialized use of memory bsc1133037. Other issue addressed: - Removed Supplements from psdocument package, so that it isn't pulled in by...

A vulnerability exists in the package management subsystem of the Cisco NX-OS network operating system, allowing a malicious actor to execute arbitrary commands.

The vulnerability in the package management subsystem of the Remote Package Manager RPM of the Cisco NX-OS network operating system in Cisco devices is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability could allow an attacker to execute...

The vulnerability of the NuGet package management system, related to deficiencies in access control, allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of the NuGet package management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information by modifying the intermediate build directory...

Fedora Update for rpm FEDORA-2018-89a3999673

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Commando VM - The First of Its Kind Windows Offensive Distribution

Welcome to CommandoVM - a fully customized, Windows-based security distribution for penetration testing and red teaming. Installation Install Script Requirements Windows 7 Service Pack 1 or Windows 10 60 GB Hard Drive 2 GB RAM Instructions 1. Create and configure a new Windows Virtual Machine...

[SECURITY] Fedora 29 Update: dnf-4.1.0-1.fc29

Utility that allows users to manage packages on their systems. It supports RPMs, modules and comps groups & environments...

Node.js third-party modules: [bower] Arbitrary File Write through improper validation of symlinks while package extraction

I would like to report file write in arbitrary locations via install command in bower It allows attackers to write arbitrary files when a malicious package is extracted. Module module name: bower version: 1.8.4 npm page: https://www.npmjs.com/package/bower Module Description Bower offers a generi...

Ubuntu: Security Advisory (USN-3846-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

What happens when packages go bad?

I built spritecow.com back in 2011, and I no longer actively maintain it. A few months ago, a user berated me for using a crypto currency miner on the site without their informed consent. And sure enough, the site's JS had a small addition that loaded the mining JS, and sent the result somewhere...

[SECURITY] Fedora 27 Update: libzypp-16.17.20-1.fc27

libzypp is a library for package management built on top of the libsolv library. It is the foundation for the Zypper package manager...

[SECURITY] Fedora 28 Update: libzypp-17.6.2-1.fc28

libzypp is a library for package management built on top of the libsolv library. It is the foundation for the Zypper package manager...

Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2016-3956

Summary HTTP bearer token leak in the npm package management tool Vulnerability Details CVE-ID: CVE-2016-3956 Description: npm could allow a remote attacker to obtain sensitive information, caused by the unintentional leakage of bearer tokens from the command-line interface. By setting up an HTTP...

[SECURITY] Fedora 28 Update: dpkg-1.18.25-1.fc28

This package provides the low-level infrastructure for handling the installation and removal of Debian software packages. This package contains the tools including dpkg-source required to unpack, build and upload Debian source packages. This package also contains the programs dpkg which used to...