PT-2022-37280 · Sass · Sass

Name of the Vulnerable Software and Affected Versions: Sass affected versions not specified Description: The issue is related to a crash in the Sass software, specifically a segmentation fault on an unknown address. The crash occurs in the Sass::unifyComplex function, which is called by...

Malicious code in sass-loadre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb51edea624a3e91103abc49a51dd9751f229edb78a32272995972dd71e8927c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5934 Malicious code in sass-lwadeoq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070ed3c51e690c8f6dcac18d9d5f8c0ede1571962b934611ac0d1c6d35e3f0f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sass-lwadeoq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070ed3c51e690c8f6dcac18d9d5f8c0ede1571962b934611ac0d1c6d35e3f0f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5933 Malicious code in sass-loadre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb51edea624a3e91103abc49a51dd9751f229edb78a32272995972dd71e8927c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-22359

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

Xxe

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

Cross site request forgery (csrf)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

Server side request forgery (ssrf)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...

CVE-2022-22359

CVE-2022-22359 affects IBM Sterling Partner Engagement Manager (Essentials/Standard editions 6.1.2, 6.2; Cloud/SaaS 22.2). Root cause: a cross-site request forgery (CSRF) flaw stemming from insufficient validation of a user request parameter, enabling an attacker to perform malicious actions on b...

CVE-2022-25758

All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service ReDoS via the loadAnnotation function, due to the usage of insecure regex...

Malicious code in gd-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd9e91f4618495cc4c59d76f8f4126c06c74a3966d97546edc9c7a8d5dbf857b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3315 Malicious code in gd-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd9e91f4618495cc4c59d76f8f4126c06c74a3966d97546edc9c7a8d5dbf857b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-with-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0946d8ce554c4342a4ca8846ecb6a66703712bbf720809ce3fdfade36925b648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Deployment Intelligence app for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2020-24025 DESCRIPTION: node-sass...

Improper Certificate Validation in node-sass affects eZ Platform

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects...

GHSA-6V6P-G8CG-2HGG Improper Certificate Validation in node-sass affects eZ Platform

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects...

-tompan-reacttemplate (>=1.0.1 <=1.1.0), 08cms (=1.0.0) +17663 more potentially affected by CVE-2020-24025 via node-sass (>=2.0.0 <=6.0.1)

node-sass NPM version =2.0.0, =1.0.1, =1.0.4, =1.0.3, =0.2.0, =0.0.1, =0.1.0, =0.1.0, =0.1.276 - 5coder-pages =0.2.0 and more Source cves: CVE-2020-24025 Source advisory: OSV:GHSA-R8F7-9PFQ-MJMV...

GHSA-R8F7-9PFQ-MJMV Improper Certificate Validation in node-sass

Certificate validation in node-sass 2.0.0 to 6.0.1 is disabled when requesting binaries even if the user is not specifying an alternative download path...

Improper Certificate Validation in node-sass

Certificate validation in node-sass 2.0.0 to 6.0.1 is disabled when requesting binaries even if the user is not specifying an alternative download path...