AZL-54313 CVE-2024-12401 affecting package cert-manager for versions less than 1.11.2-18

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service DoS vector for the cert-manag...

CVE-2024-12401

CVE-2024-12401 is a DoS in the cert-manager package where an attacker able to modify PEM data read by cert-manager (e.g., in a Secret) can trigger high CPU usage in the cert-manager controller pod. Public details in connected IBM notes and vendor advisories confirm the issue, with a CVSS base sco...

CVE-2024-12401 Cert-manager: potential dos when parsing specially crafted pem inputs

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service DoS vector for the cert-manag...

CVE-2024-12401

A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service DoS vector for the cert-manag...

secretmem: disable memfd_secret() if arch cannot set direct map

...

MAL-2024-11807 Malicious code in nayan-api-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3aa649015a7b9b6a0c072dff43fa33c006eb20cdc5039c2ba526d686ec328223 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11804 Malicious code in fake-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41407456feff64ada241bb9174752b12b3533a3827629a708296e06c3379fa7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PQClean has a correctness error in HQC decapsulation

Impact A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation...

GHSA-753P-WRJ5-G8FJ PQClean has a correctness error in HQC decapsulation

Impact A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation...

Malicious code in shyftportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c420e2c055c4dac21abe5aa3deacde16aef6dcd57335d4244adffc4346365a2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Secret Blizzard Deploys Kazuar Backdoor in Ukraine Using Amadey Malware-as-a-Service

The Russian nation-state actor tracked as Secret Blizzard has been observed leveraging malware associated with other threat actors to deploy a known backdoor called Kazuar on target devices located in Ukraine. The new findings come from the Microsoft threat intelligence team, which said it observ...

PT-2024-40144 · Pqclean · Pqclean

Name of the Vulnerable Software and Affected Versions: PQClean affected versions not specified Description: A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism, where an indexing error causes part of the secret key to be incorrectly treat...

Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass...

CVE-2024-45494

An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 Fixed in 7.0.0. The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected...

CVE-2024-45494

An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 Fixed in 7.0.0. The FieldServer Gateway has an internally used shared administrative user account on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected...

Malicious code in passport-openpass-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0761835d95103228401a69c1b951451a6a5698da0f7edec16514d5072d6b6051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-54137

A flaw was found in the liboqs library. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This issue results in an incorrect shared secret valu...

Malicious code in playwright-1.45 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a60a2a7e0e26a3252aaec3534c214513245613c9850f72abbdefc21de170d304 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-55578

Zammad before 6.4.1 places sensitive data such as authmicrosoftoffice365credentials and applicationsecret in log files...

CVE-2024-55578

Summary: CVE-2024-55578 affects Zammad prior to 6.4.1, where sensitive data (e.g., auth_microsoft_office365_credentials and application_secret) is written to log files. Affected software: Zammad