GHSA-9W38-P64V-XPMV vulnerabilities

Vulnerabilities for packages: celeborn, tez, druid, hadoop-client-modules, trino, cassandra-reaper...

GHSA-XJP4-HW94-MVP5 vulnerabilities

Vulnerabilities for packages: celeborn, tez, druid, hadoop-client-modules, trino, cassandra-reaper...

CVE-2024-29131 vulnerabilities

Vulnerabilities for packages: celeborn, tez, druid, hadoop-client-modules, trino, cassandra-reaper...

CVE-2024-29133 vulnerabilities

Vulnerabilities for packages: celeborn, tez, druid, hadoop-client-modules, trino, cassandra-reaper...

CVE-2022-37601 affecting package reaper for versions less than 3.1.1-7

CVE-2022-37601 affecting package reaper for versions less than 3.1.1-7. A patched version of the package is available...

CVE-2023-28155 affecting package reaper for versions less than 3.1.1-7

CVE-2023-28155 affecting package reaper for versions less than 3.1.1-7. A patched version of the package is available...

CVE-2018-11694 affecting package reaper for versions less than 3.1.1-7

CVE-2018-11694 affecting package reaper for versions less than 3.1.1-7. A patched version of the package is available...

AZL-36895 CVE-2024-28849 affecting package reaper for versions less than 3.1.1-9

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials...

AZL-34439 CVE-2023-42282 affecting package reaper for versions less than 3.1.1-10

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via isPublic...

CBL Mariner 2.0 Security Update: reaper (CVE-2023-26159)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-26159 advisory. - Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to th...

CVE-2023-26159 affecting package reaper for versions less than 3.1.1-8

CVE-2023-26159 affecting package reaper for versions less than 3.1.1-8. A patched version of the package is available...

AZL-32314 CVE-2023-26159 affecting package reaper for versions less than 3.1.1-8

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse function. When new URL throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect...

AZL-31719 CVE-2023-46234 affecting package reaper for versions less than 3.1.1-9

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any...

AZL-32226 CVE-2022-26592 affecting package reaper for versions less than 3.1.1-9

Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::hasrealparentref function...

CBL Mariner 2.0 Security Update: reaper (CVE-2018-11694)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2018-11694 advisory. - An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function...

CVE-2022-37601 affecting package reaper for versions less than 3.1.1-3

CVE-2022-37601 affecting package reaper for versions less than 3.1.1-3. A patched version of the package is available...

HookSpoofer A Novel Infostealer with Advanced Capabilities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary North Korea-linked hacking group Reaper has recently been observed engaging in surveillance of North Korean defectors. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...

Reaper, North Korean hacking group, targets defectors

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary North Korea-linked hacking group Reaper has recently been observed engaging in surveillance of North Korean defectors. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...

AZL-25664 CVE-2023-28155 affecting package reaper for versions less than 3.1.1-5

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect HTTP to HTTPS, or HTTPS to HTTP. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

SUSE CVE-2018-1000200

The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory OOM killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exitmmap, which calls munlockvmapagesall for mlocked vmas.This can happen...