MAL-2024-1060 Malicious code in unity-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d000b4d34f837a9755c05f72318c44ba0f8cf265e46224607cedae43aea73ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1064 Malicious code in pet-profile-micro-interaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd98e11aca525f441300cc29d3cebd96d52cee8d8620e951a805b48fe9305d33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Secrets Sensei: Conquering Secrets Management Challenges

In the realm of cybersecurity, the stakes are sky-high, and at its core lies secrets management — the foundational pillar upon which your security infrastructure rests. We're all familiar with the routine: safeguarding those API keys, connection strings, and certificates is non-negotiable. Howeve...

UBUNTU-CVE-2024-1299

A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of managegroupaccesstokens to rotate group access tokens with owner privileges...

BIT-GITLAB-2021-22215

An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects...

CVE-2024-1901

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable...

CVE-2024-1901

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable...

Authentication flaw

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable...

CVE-2024-1901

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable...

CVE-2024-1901

CVE-2024-1901 describes a denial of service in Devolutions Server 2023.3.14.0 during PAM password rotation in the check-in process. An authenticated user with specific PAM permissions can render PAM credentials unavailable. The CVSS vector indicates network access, low attack complexity, and low ...

Devolutions Server Security Vulnerability

Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2023.3.14.0 and prior versions, which originates from PAM password rotation during the sign-in...

openSUSE: Security Advisory for SUSE Manager 4.3.11 Release Notes (SUSE-SU-2024:0513-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin

Impact SDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes. Doing so would result in the auth token being built into the application bundle, and therefore the auth token could be...

MAL-2024-1047 Malicious code in tokenspair (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ccf75851f35b0d70ab977246300e05d579dafe5efa919e96448054ea7c3c7f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1045 Malicious code in tokenpair (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 452944cb4e2ff250e4ad6bf1244ac317ba5e0d4f357b1c6aaeda2b3f72b3e1c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1042 Malicious code in frd-rsa-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8787b5e0e6583bf27e7ad1a0f2da3d1fc03021fa9a8957e681cc9c79c0f6acd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Three Tips to Protect Your Secrets from AI Accidents

Last year, the Open Worldwide Application Security Project OWASP published multiple versions of the "OWASP Top 10 For Large Language Models," reaching a 1.0 document in August and a 1.1 document in October. These documents not only demonstrate the rapidly evolving nature of Large Language Models,...

MAL-2024-1028 Malicious code in disc-web-sender (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12df226ff9607452aa9f412f4bbaffcae930e8586ee8348d0d9aa9d03238f050 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-red-contrib-object-to-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc617e826788805ca870b385151ace964f43893d9560c8b2d9615276520929a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1032 Malicious code in testconfusiontestt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68716301fda6917d0a2abf5455e1ab2d5780d533eb27a1033a84888b0f9677eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...