MAL-2024-9137 Malicious code in cap-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c67eacc7aaa76752177a54808d1dec8de27842394b3a20bcf9b51fc779b9417 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45160

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty clientpassword parameter client secret...

Malicious code in nanoslackts-env-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe61e9c24b26d76088e167848056dfe52c47156a72948c418b51b949e65b3e05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdk-integration-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03dafa3e57d86169a6645da2a922b01ee1da954a3b98e6cf5c31c63575cdd133 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9185 Malicious code in snyk.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76c8b0ab07e37f58fd612860770162ef6e593d6f155a12952b7eafe0afa9ffdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in openai-bun-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 224d5cc373a08c5cb79261ea9fc3c71f16a5b2b64a3582fd82a1f624e541448d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9135 Malicious code in branch-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1be4b8afeed9f4f3ece58c4cfde48b3909e1c22e69a8267c4e156326a79d7235 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-JQH2-CH7P-XWXH Quarkus CXF logs passwords and other secrets

A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging...

Malicious code in sd-template-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1d800f01a52aafc7bee8ab45032560696e9e36ca3c902a4adc7d1245294fc0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-7206

SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware...

VulnCheck KEV: CVE-2024-9014

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data...

Information Exposure Through An Error Message

org.jenkins-ci.main:jenkins-core is vulnerable to Information Exposure Through an Error Message. The vulnerability is due to improper redaction of multi-line secret values in error messages generated from form submissions involving the secretTextarea form field...

Malicious code in o-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc143165633782b48a2d1e1f1d68c10256845041b7b67b0b8c8410107e1ed3f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in m-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57e450947ea7b047b2ac4e80c9e97314a41934d654cf6a821829a0bf9d51c521 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-api-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14532f4785bce55a885a6fd2945c9705ab690e1385adeee16c6d8d2d9420b4b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hulululu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50cd582df4ddf139ea1ee884391d575059485ee4b4b14852d9b845ab23f53121 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in reference-implementation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 051f4d558f24b6f5d2f54e122fac061a3312288839b9679ffcdadf0210dd32fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-JENKINS-2024-47803

Jenkins LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field...

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

Impact Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors. Workarounds Check that you are not using sensitive...

GHSA-WPR2-J6GR-PJW9 OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

Impact Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors. Workarounds Check that you are not using sensitive...