Malicious code in @juiggitea/amet-cupiditate-fugiat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94f62fe064c189896bbcb72c87b6e37c6191013d4fa827ee24a85ba9abbcfc14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions

Now-patched authorization bypass issues impacting Cox modems could have been abused as a starting point to gain unauthorized access to the devices and run malicious commands. "This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could've...

ROS-20240603-02

A vulnerability in the Format Detection component of the Mojolicious module for Perl is related to errors in releasing resources. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of denial of service A vulnerability in the securecompare function of the...

RHEL 8 : python-twisted (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - dev-python/twisted: secret exposure in cross-origin redirects CVE-2022-21712 - Twisted is an event-based...

RHEL 8 : nss (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nss: Cache side-channel variant of the Bleichenbacher attack CVE-2018-12404 - nss: Information exposure...

Slack integration leaks sensitive information in logs

Impact Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, it is possible under specific configurations, an attacker can forge reques...

GHSA-C2G2-GX4J-RJ3J Slack integration leaks sensitive information in logs

Impact Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, it is possible under specific configurations, an attacker can forge reques...

CVE-2024-35196 Slack integration leaks sensitive information in logs in Sentry

Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, i...

CVE-2024-35196 Slack integration leaks sensitive information in logs in Sentry

Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, i...

Malicious code in cedar-snippet (npm)

This package is considered malicious because it communicates with a domain associated with malicious activity and the package executes one or more commands associated with malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware...

Malicious code in nespresso-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4df4d16cd100a965fef42c58150e9688849a5acfa8de2f809b3ed66f5ef9f29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the application programming interface of the Delinea Secret Server management software allows a perpetrator to bypass the authentication process.

The vulnerability of the application programming interface of the Delinea Secret Server management software relates to the use of cryptographic algorithms with a hard-programmed key for encryption. Exploiting this vulnerability could allow a malicious actor to bypass authentication procedures...

CVE-2024-32988

The CVE covers the OfferBox Android apps (2.0.0–2.3.17) and iOS apps (2.1.7–2.6.14) that embed a hard-coded JWT secret in the binary, enabling retrieval by reverse engineering. The root cause is a hard-coded secret key used for JWT authentication, which poses confidentiality risk if extracted. Pu...

CVE-2024-32988

'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT may be retrieved if the application binary is reverse-engineered...

CVE-2024-32988

'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT may be retrieved if the application binary is reverse-engineered...

DEBIAN-CVE-2021-47463

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix NULL page-mapping dereference in pageissecretmem Check for a NULL page-mapping before dereferencing the mapping in pageissecretmem, as the page's mapping can be nullified while gup is running, e.g. by reclaim or...

PT-2024-25035 · Unknown · Offerbox App For Android +1

Name of the Vulnerable Software and Affected Versions: OfferBox App for Android versions 2.0.0 through 2.3.17 OfferBox App for iOS versions 2.1.7 through 2.6.14 Description: The 'OfferBox' App for Android and iOS uses a hard-coded secret key for JWT. This secret key may be retrieved if the...

PT-2024-24129 · Open Quantum Safe · Liboqs

Name of the Vulnerable Software and Affected Versions: Open Quantum Safe liboqs version 10.0 Description: An issue in Open Quantum Safe liboqs allows a remote attacker to escalate privileges via the crypto sign signature parameter in the /pqcrystals-dilithium-standard ml-dsa-44-ipd avx2/sign.c...

GHSA-7V7M-PCW5-H3CG Pusher Service Channel Authentication Bypass

The service offered by Pusher provides "private" channels with an authentication mechanism that restricts subscription access. The decision on allowing subscriptions to private channels is delegated to customers, who implement an authentication endpoint. End-users request a token from this endpoi...

DEBIAN-CVE-2024-35872

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix GUP-fast succeeding on secretmem folios folioissecretmem currently relies on secretmem folios being LRU folios, to save some cycles. However, folios might reside in a folio batch without the LRU flag set, or...