SUSE CVE-2019-18798

LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in astselweave.cpp...

node-sass-with-bindings (>=4.5.5, <=4.5.6) potentially affected by CVE-2022-25895 via lite-dev-server (3.2.7)

lite-dev-server NPM version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on lite-dev-server and may be impacted: - node-sass-with-bindings =4.5.5, =4.5.6 Source cves: CVE-2022-25895 Source advisory: OSV:GHSA-PPPV-CH8P-RP2W...

node-sass-with-bindings (>=4.5.5, <=4.5.6) potentially affected by CVE-2022-25895 via lite-dev-server (3.2.7)

lite-dev-server NPM version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on lite-dev-server and may be impacted: - node-sass-with-bindings =4.5.5, =4.5.6 Source cves: CVE-2022-25895 Source advisory: SNYK:JS-LITEDEVSERVER-3153718...

OSV-2022-896 Segv on unknown address in Sass::unifyComplex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51316 Crash type: Segv on unknown address Crash state: Sass::unifyComplex Sass::Extender::extendCompound Sass::Extender::extendComplex...

PT-2022-37280 · Sass · Sass

Name of the Vulnerable Software and Affected Versions: Sass affected versions not specified Description: The issue is related to a crash in the Sass software, specifically a segmentation fault on an unknown address. The crash occurs in the Sass::unifyComplex function, which is called by...

Malicious code in sass-loadre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb51edea624a3e91103abc49a51dd9751f229edb78a32272995972dd71e8927c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sass-lwadeoq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070ed3c51e690c8f6dcac18d9d5f8c0ede1571962b934611ac0d1c6d35e3f0f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5933 Malicious code in sass-loadre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb51edea624a3e91103abc49a51dd9751f229edb78a32272995972dd71e8927c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5934 Malicious code in sass-lwadeoq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070ed3c51e690c8f6dcac18d9d5f8c0ede1571962b934611ac0d1c6d35e3f0f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-22359

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

Cross site request forgery (csrf)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

Xxe

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

Server side request forgery (ssrf)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...

CVE-2022-22359

CVE-2022-22359 affects IBM Sterling Partner Engagement Manager (Essentials/Standard editions 6.1.2, 6.2; Cloud/SaaS 22.2). Root cause: a cross-site request forgery (CSRF) flaw stemming from insufficient validation of a user request parameter, enabling an attacker to perform malicious actions on b...

CVE-2022-22359: Cross-Site Request Forgery (CSRF)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

CVE-2022-25758

All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service ReDoS via the loadAnnotation function, due to the usage of insecure regex...

Malicious code in gd-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd9e91f4618495cc4c59d76f8f4126c06c74a3966d97546edc9c7a8d5dbf857b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3315 Malicious code in gd-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd9e91f4618495cc4c59d76f8f4126c06c74a3966d97546edc9c7a8d5dbf857b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-with-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0946d8ce554c4342a4ca8846ecb6a66703712bbf720809ce3fdfade36925b648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Deployment Intelligence app for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2020-24025 DESCRIPTION: node-sass...