GHSA-J26W-F9RQ-MR2Q vulnerabilities

Vulnerabilities for packages: cassandra-reaper, apache-hop-fips, spark, spark-fips, apache-hop...

CVE-2024-9823 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, apache-hop-fips, spark, spark-fips, apache-hop...

CBL Mariner 2.0 Security Update: python-tensorboard / reaper (CVE-2024-43796)

The version of python-tensorboard / reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43796 advisory. - Express.js minimalist web framework for node. In express 4.20.0, passing untrusted user...

CVE-2024-43796 affecting package reaper for versions less than 3.1.1-12

CVE-2024-43796 affecting package reaper for versions less than 3.1.1-12. A patched version of the package is available...

AZL-50322 CVE-2024-48949 affecting package reaper for versions less than 3.1.1-13

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S.gtesig.eddsa.curve.n || sig.S.isNeg" validation...

AZL-50114 CVE-2024-47764 affecting package reaper for versions less than 3.1.1-13

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-42459)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42459 advisory. - In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-42461)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42461 advisory. - In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signature...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-42460)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42460 advisory. - In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing...

AZL-49126 CVE-2024-45590 affecting package reaper for versions less than 3.1.1-13

body-parser is Node.js body parsing middleware. body-parser 1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in...

CosmicBeetle Deploys Custom ScRansom Ransomware, Partnering with RansomHub

The threat actor known as CosmicBeetle has debuted a new custom ransomware strain called ScRansom in attacks targeting small- and medium-sized businesses SMBs in Europe, Asia, Africa, and South America, while also likely working as an affiliate for RansomHub. "CosmicBeetle replaced its previously...

AZL-49147 CVE-2024-43800 affecting package reaper for versions less than 3.1.1-13

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

AZL-49123 CVE-2024-43799 affecting package reaper for versions less than 3.1.1-13

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect which executes untrusted code. This issue is patched in send 0.19.0...

AZL-49117 CVE-2024-45296 affecting package reaper for versions less than 3.1.1-13

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

CVE-2024-42461 affecting package reaper for versions less than 3.1.1-11

CVE-2024-42461 affecting package reaper for versions less than 3.1.1-11. A patched version of the package is available...

CVE-2024-42460 affecting package reaper for versions less than 3.1.1-11

CVE-2024-42460 affecting package reaper for versions less than 3.1.1-11. A patched version of the package is available...

CVE-2024-42459 affecting package reaper for versions less than 3.1.1-11

CVE-2024-42459 affecting package reaper for versions less than 3.1.1-11. A patched version of the package is available...

AZL-47430 CVE-2024-42460 affecting package reaper for versions less than 3.1.1-11

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero...

AZL-47425 CVE-2024-42461 affecting package reaper for versions less than 3.1.1-11

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed...

AZL-47421 CVE-2024-42459 affecting package reaper for versions less than 3.1.1-11

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended...