Malicious code in prmnmd-tuls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 422a0a19eabc0aeb101d13844348daed919589aa7aa3b6567c3146a5850c7678 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in modernliner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware baf623671632e06ed7e8e26020d02280a1f33a08072118d85f4308e61cb33cba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @illimity/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 740bece39d068261516307ed31d745ce0d411396f96f9e57fe0abdec13f0ef8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in toolbox-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2df94f6499b37161c460ae24047d64d2db531042b7ea4e2f4138128bf723acdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-48396 Apache SeaTunnel Web: Authentication bypass

Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affect...

Malicious code in ent-widget-phone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7313a06ff628db941fa9330887fdea43ce979086e4ce11ef7d0c0041a9a0f9b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7845 Malicious code in cordova-plugin-acuant (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ee353c7e6360a7550bd55e7929ef39d3d72273c2d3a370403e3a4082528fe30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in symphony-familiarity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eff03dd28a4225440b053e0619ca9619d5c18fbd90e59b8513587d836b4df052 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ent-widget-military (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbdebed9b78571c779a871a94b08827dce4891379340dbcdcac9864d33d6435d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ent-widget-addcap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dac2383ab705d5e1f919508cfae3ccfb37e6f6ae1eca078ed12436c55bc7be6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ent-widget-address (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9273fe0a35c0d622fe4cfcd42ee9fccba89cdaa4c258f0f4af1d476f8d87d38e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7806 Malicious code in overflood (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2742524e3d45bc5658d4f5feb0b8e3a1260967a2770e238934fa475a7e7e211b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Secret Exposure

ops is vulnerable to Secret Exposure. The vulnerability is due to improper handling of secret content by passing it as CLI arguments which affects charms using Juju =3.0 and not correctly capturing and processing subprocess.CalledProcessError. The vulnerability allows an attacker to gain access t...

GO-2024-2987 Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper

Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper...

GHSA-HCMV-JMQH-FJGM ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

Summary The issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processing subprocess.CalledProcessError. There are two points that may log this command, in...

CVE-2024-41129 The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processi...

Malicious code in sap-ac (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 870a5115e5b80eb328e2100fc8e18af8a1dfea9e5dde756b2c4fad13bda5b53d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sap-accesslevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a9eef95084b4052715fcbefc82b3ebb9680371d43f189ca1d39bb75af3c2a9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Configuring a Host connection to Azure Gov Secret

When attempting to configure a Host in Citrix DAAS for Azure Gov Secret, it is not one of the options in the GUI...

CVE-2024-41122

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...