[SECURITY] Fedora 38 Update: dotnet6.0-6.0.120-1.fc38

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 37 Update: dotnet7.0-7.0.109-1.fc37

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Business Developer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 used by Rational Business Developer. Rational Business Developer has provided fixes for the applicable CVEs. These issues were disclosed as part of the IBM Java...

X/crisis Does Not Charge ConstantFee

github.com/cosmos/cosmos-sdk is vulnerable to inconstant Fee. If a transaction is sent to the x/crisis module to check an invariant, the ConstantFee parameter of the chain is NOT charged. All versions of the x/crisis module are affected on all versions of the Cosmos SDK...

.NET 7.0 security, bug fix, and enhancement update

7.0.109-1.0.1 - Set TargetRid based on os release major version, add OL arm64 RuntimeIdentifier Orabug: 34671152 7.0.109-1 - Update to .NET SDK 7.0.109 and Runtime 7.0.9 - Resolves: RHBZ2219632...

CVE-2023-37259

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

CVE-2023-37259

CVE-2023-37259 affects matrix-react-sdk. The Export Chat feature injects attacker-controlled elements into a generated document without proper escaping, causing stored XSS. The exploit runs from the null origin (document-only context) but can be used to leak message contents; a malicious homeserv...

CVE-2023-37259 Cross site scripting in Export Chat feature

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

CVE-2023-37259 Cross site scripting in Export Chat feature

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

CVE-2023-37259 Cross site scripting in Export Chat feature

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting XSS. Since the Export Chat feature...

matrix-react-sdk 跨站脚本漏洞

matrix-react-sdk is a Matrix open source component for inserting the Matrix chat/voip client into web pages. A cross-site scripting vulnerability exists in matrix-react-sdk versions 3.32.0 through 3.76.0, which stems from the Export Chat feature containing certain attacker-controlled elements in...

VulnCheck KEV: CVE-2023-33999

Freemius SDK for WordPress is vulnerable to a reflected cross site scripting vulnerability due to improper sanitization...

CVE-2023-37479 Improper sanitization of MXCSR and RFLAGS in OpenEnclave

Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environments, also known as Enclaves. There are two issues that are mitigated in version 0.19.3. First, Open Enclave SDK does not properly sanitize the MXCSR register ...

Privilege Escalation

github.com/cosmos/cosmos-sdk is vulnerable to Privilege Escalation. Attackers are able to setup a victim's account as a malicious vesting account, which allows depositing funds but prohibiting withdrawals, thanks to the PeriodicVestingAccount function defined in x/auth. As a result, you cannot...

MAL-2023-1081 Malicious code in @hubportal/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a5339f716a6209e3408d4781031aabf5634245533ce5d1ba42df2f82e912e622 The OpenSSF Package Analysis project identified '@hubportal/sdk' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in @hubportal/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a5339f716a6209e3408d4781031aabf5634245533ce5d1ba42df2f82e912e622 The OpenSSF Package Analysis project identified '@hubportal/sdk' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

PT-2023-25989 · Unknown · Open Enclave

Name of the Vulnerable Software and Affected Versions: Open Enclave versions prior to 0.19.3 Description: The issue concerns two problems in the Open Enclave SDK. First, it does not properly sanitize the MXCSR register on enclave entry, making applications vulnerable to MXCSR Configuration...

PT-2023-4189 · Ibm +3 · Ibm Sdk +4

Name of the Vulnerable Software and Affected Versions: IBM SDK, Java Technology Edition versions 7.1.5.18 through 8.0.8.0 Description: The issue is related to an unsafe deserialization flaw in the Java Technology Edition, which could allow a remote attacker to execute arbitrary code on the system...

.NET 6.0 security, bug fix, and enhancement update

6.0.120-1.0.1 - Add missing Oracle Linux Runtime IDs 6.0.120-1 - Update to .NET SDK 6.0.120 and Runtime 6.0.20 - Resolves: RHBZ2219637...

Malicious code in nextcloud-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis be6d2af367680b5d332b3472317eeab4a364c78e1617e1d7f3a32f1d797fcdc8 The OpenSSF Package Analysis project identified 'nextcloud-api-sdk' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...