[SECURITY] Fedora 39 Update: dotnet7.0-7.0.117-1.fc39

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Malicious code in @sber-sd/assistant-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82069e81085e1a22a51773833e3b1a9b2b492b06fa5249a27bd12e09c329e9f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1246 Malicious code in @sber-sd/assistant-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82069e81085e1a22a51773833e3b1a9b2b492b06fa5249a27bd12e09c329e9f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 38 Update: dotnet8.0-8.0.103-1.fc38

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 39 Update: dotnet8.0-8.0.103-1.fc39

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Security Update for Microsoft .NET Core SDK (April 2024)

The version of .NET Core SDK installed on the remote host is 6.x prior to 6.0.29, 7.x prior to 7.0.18 or 8.x prior to 8.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2024 advisory: - A remote code execution vulnerability. An attacker can exploit this to...

Security Bulletin: IBM QRadar App SDK for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. This product is only used by IBM QRadar SIEM app developers and external business partners and is not relevant for users...

Security Bulletin: There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM TXSeries for Multiplatforms (CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049).

Summary There are multiple vulnerabilities in the IBM SDK, Java Technology Edition that is shipped with IBM TXSeries for Multiplatforms CVE-2023-22081, CVE-2023-22067, CVE-2023-5676, CVE-2023-22045 and CVE-2023-22049. An update to IBM TXSeries for Multiplatforms has been released to address these...

Malicious code in payable-js-ipg-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4236d1ddc2eb9ca710a495ee98481d2a581fee6451b8e496835e93c54f92c1a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in payable-js-ipg-sdk-suba (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d702ab64f07220d7376645a0d0ad2d86688a3162960e49bd09ae493b567f43ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1207 Malicious code in payable-js-ipg-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4236d1ddc2eb9ca710a495ee98481d2a581fee6451b8e496835e93c54f92c1a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the `on_receive_session_packet_ack` function in the `libv2_sdk.so` library of DJI’s quadrocopters—such as the DJI Mavic 3 Pro, DJI Mavic 3, DJI Mavic 3 Classic, DJI Mavic 3 Enterprise, DJI Matrice 300, DJI Matrice M30, DJI Mavic Mini 3 Pro—allows a intruder to disclose protected information or execute arbitrary code.

The vulnerability of the onreceivesessionpacketack function in the libv2sdk.so library of DJI’s quadrocopters, such as the DJI Mavic 3 Pro, DJI Mavic 3, DJI Mavic 3 Classic, DJI Mavic 3 Enterprise, DJI Matrice 300, DJI Matrice M30, and DJI Mavic Mini 3 Pro, is related to unvalidated array indexin...

GHSA-J496-CRGH-34MX ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks

Name: ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks Component: ibc-go Criticality: Critical ACMv1: I:Critical; L:AlmostCertain Affected versions: v4.6.0, v5.4.0, v6.3.0, v7.4.0, v8.2.0 Affected users: Chain Builders + Maintainers Summary Through the deployment and...

CVE-2023-6948

A Buffer Copy without Checking Size of Input issue affecting the v2sdkservice running on a set of DJI drone devices on the port 10000 could allow an attacker to cause a crash of the service through a crafted payload triggering a missing input size check in the sdkprintf function implemented in th...

CVE-2023-6948

CVE-2023-6948 affects DJI drone devices running v2_sdk_service on port 10000. The issue is a Buffer Copy without Checking Size of Input in sdk_printf within libv2_sdk.so used by the dji_vtwo_sdk binary, enabling a crafted payload to crash the service and cause denial of service (availability impa...

Malicious Apps Caught Secretly Turning Android Phones into Proxies for Cybercriminals

Several malicious Android apps that turn mobile devices running the operating system into residential proxies RESIPs for other threat actors have been observed on the Google Play Store. The findings come from HUMAN's Satori Threat Intelligence team, which said the cluster of VPN apps came fitted...

BIT-HELM-2024-26147 Helm's Missing YAML Content Leads To Panic

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would...

MAL-2024-1161 Malicious code in galileo-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1ea1d3425cddab091828432f9dffef7f8bc36f5fbf9bcd0e01dffe737417e92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in galileo-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1ea1d3425cddab091828432f9dffef7f8bc36f5fbf9bcd0e01dffe737417e92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Heap-based Buffer Overflow

azure-c-shared-utility is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to inadequate parameter checking mechanisms, which can be exploited through the buffer length parameter in the Azure C SDK, potentially leading to remote code execution...