io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2021-3859 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...

com.pep1:pep1-commons-rest (0.6), io.syndesis:http-pull-push-example (>=0.4.2, <=0.4.5) +5 more potentially affected by CVE-2021-3859 via io.undertow:undertow-core (1.3.27.final)

io.undertow:undertow-core MAVEN version 1.3.27.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.pep1:pep1-commons-rest 0.6 - io.syndesis:http-pull-push-example =0.4.2, =0.4.2, =0.4.2, =0.4.5 -...

com.github.dkubiak:goldfish-collector-maven (1.0), com.github.dkubiak:goldfish-server (1.0) +3 more potentially affected by CVE-2021-3690 via io.undertow:undertow-core (1.1.4.final)

io.undertow:undertow-core MAVEN version 1.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.dkubiak:goldfish-collector-maven 1.0 - com.github.dkubiak:goldfish-server 1.0 -...

com.pep1:pep1-commons-rest (0.6), io.syndesis:http-pull-push-example (>=0.4.2, <=0.4.5) +5 more potentially affected by CVE-2021-3690 via io.undertow:undertow-core (1.3.27.final)

io.undertow:undertow-core MAVEN version 1.3.27.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.pep1:pep1-commons-rest 0.6 - io.syndesis:http-pull-push-example =0.4.2, =0.4.2, =0.4.2, =0.4.5 -...

io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2021-3690 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...

io.undertow:undertow-servlet (1.1.7.final), io.undertow:undertow-websockets-jsr (1.1.7.final) +1 more potentially affected by CVE-2021-3690 via io.undertow:undertow-core (1.1.7.final)

io.undertow:undertow-core MAVEN version 1.1.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.7.final - io.undertow:undertow-websockets-jsr 1.1.7.final -...

io.undertow:undertow-servlet (1.3.26.final), io.undertow:undertow-websockets-jsr (1.3.26.final) +9 more potentially affected by CVE-2021-3690 via io.undertow:undertow-core (1.3.26.final)

io.undertow:undertow-core MAVEN version 1.3.26.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.26.final - io.undertow:undertow-websockets-jsr 1.3.26.final -...

Security Bulletin: IBM Security Verify Information Queue web-app container is vulnerable to denial of service attack (CVE-2022-35283)

Summary The web-app container in IBM Security Verify Information Queue ISIQ v10.0.2 can be shut down with a malformed HTTP request. ISIQ v10.0.3 has implemented stricter URL validation to prevent this type of denial of service attack. CVE-2022-35283 Vulnerability Details CVEID:CVE-2022-35283...

com.alibaba.csp:sentinel-datasource-nacos (0.2.0), com.alibaba.csp:sentinel-demo-nacos-datasource (0.2.0) +3 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.2.0)

com.alibaba.nacos:nacos-client MAVEN version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 0.2.0 - com.alibaba.csp:sentinel-demo-nacos-datasource...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0-rc1, <=0.2.1), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0-rc1, <=0.2.1) +3 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.2.1-rc1)

com.alibaba.nacos:nacos-client MAVEN version 0.2.1-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0-rc1, =0.1.0-rc1, =0.1.0-rc1, =0.1.0-rc...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.3, <=0.2.3), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.3, <=0.2.3) +63 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.1.3)

com.alibaba.nacos:nacos-client MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.3, =0.1.3, =2.7.7, =1.0.0, =1.0.0, =1.0.0,...

org.nutz:nutzboot-starter-nacos-config-client (>=2.3.1.v20190318, <=2.3.7.v20190731) potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.9.0)

com.alibaba.nacos:nacos-client MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - org.nutz:nutzboot-starter-nacos-config-client =2.3.1.v20190318, =2.3.7.v20190731 Source cves:...

com.github.hengboy:micro-job-autoconfigure (0.0.3.release), com.github.hengboy:micro-job-registry-nacos (0.0.3.release) +9 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.8.2)

com.alibaba.nacos:nacos-client MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.github.hengboy:micro-job-autoconfigure 0.0.3.release -...

Malicious Package

Overview wad-workshop-starter is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview starter-react-frontend-app is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

Malicious code in wad-workshop-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b52731d8d5da8ee84613a13cbe9af2b0c7ad22280e6b81e461977257d682892 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fed-challenge-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 225b081f29561b9d3a9e737de52432acb6d9d59794a1d05e2ec47e1d8d8721c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2998 Malicious code in fed-challenge-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 225b081f29561b9d3a9e737de52432acb6d9d59794a1d05e2ec47e1d8d8721c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wf-kyt-starter-universal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04b5c444b3322f081575357114b16efafce8ede863084892e01e10bf6b7f00ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7121 Malicious code in wf-kyt-starter-universal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04b5c444b3322f081575357114b16efafce8ede863084892e01e10bf6b7f00ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...