MAL-2024-10984 Malicious code in kraken-wallet-cryptoicons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5445e7a104fb812aa6f8ed5418680946ff853713215035b76d12e7bdd6a19300 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10959 Malicious code in debugr1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d8da47712ca04d79a2bec26869c777f7581be1aeb31aeacf3d22c37fdc27ce6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10965 Malicious code in eslint-config-merchant-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea010276955c1c1858ef9fb9c699f976c6d338a1c3767b444b7b03ce8d802673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10948 Malicious code in thre-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4823222bd132c06ad184ec3e59942da59e35bf3ea088248a65305f89c0f1716 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rc-network (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92fa4153701892bbacd5a9c984d56b98fb7dde59df2dc84760fe47af95bad5fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cloud-functions-schedule-instance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d10678b76e1cf601f3ff31de7642b60bd56df7c7899eb2c23808c2ef0ebf778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-7F6P-PHW2-8253 Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws

Coinbase researchers reported 2 security issues in our implementation of the oblivious transfer OT based protocol DKLS: 1. Secret share recovery attack If the base OT setup of the protocol is reused for another execution of the OT extension, then a malicious participant can extract a bit of the...

Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws

Coinbase researchers reported 2 security issues in our implementation of the oblivious transfer OT based protocol DKLS: 1. Secret share recovery attack If the base OT setup of the protocol is reused for another execution of the OT extension, then a malicious participant can extract a bit of the...

MAL-2024-10923 Malicious code in delta-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a63f8d77e78e8b2cbc3bc3bfa80ee50373c5e9eb8cd9962c51a4a0ebec4b7cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fixsolara (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72f721f96c41e95f79c4f9d2a12a8d040ae4c360e5d8e429d2ef42be2878121c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in clarity-vs-code-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9931dae1aea529cfab0af59c13f394053428a779eb80926016e72d7e8447b19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dashlane-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79f2a48c1181725012456cc91fb5af9013cdea7e6e5b193c8cd5947f247a4d52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in maven-dependency-submission-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1381f1caf30bbc11135c6f4ffc6634a4cdeaaa63627d583675758c564c38c804 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-V5H2-Q2W4-GPCX Sentry improper error handling leaks Application Integration Client Secret

Impact During routine testing, we identified a scenario where a specific error message generated by our platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the...

Sentry improper error handling leaks Application Integration Client Secret

Impact During routine testing, we identified a scenario where a specific error message generated by our platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the...

CVE-2024-53253

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

PYSEC-2024-310

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

CVE-2024-53253 Sentry's improper error handling leaks Application Integration Client Secret

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

CVE-2024-53253 Sentry's improper error handling leaks Application Integration Client Secret

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

CVE-2024-53253

CVE-2024-53253 affects Sentry v24.11.0 (self-hosted); a specific error message could leak plaintext integration Client ID and Client Secret in an HTTP response when a failing third‑party response triggers select-requester.invalid-response during a Search UI async flow. The leak does not grant dat...