CVE-2024-31497

In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant...

Malicious code in heroicons1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28bcce7dcd6942284e70d474af5e6e6343689f9cba20393e07d9bbabf4af5076 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1255 Malicious code in deprecation-silencer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c51728830d7aed5b2134c0a91306e13560b271e8508376b3364616e35473898e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1257 Malicious code in discourse-markdown-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d15650dd9d3ef6040ce65c2e6b3207c96240af179ecbc7061ed5064205df4673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1261 Malicious code in trip-component-platform-online-goto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9bf43d6e49697b8f9e4d87c7cc739e1b31a2db5132fabce880c79cb4d1fd860 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

KLA65599 OSI vulnerability in PuTTY

Information disclosure vulnerability was found in PuTTY. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories oss-security – CVE-2024-31497: Secret Key Recovery of NIST P-521 Private Keys Through Biased ECDSA Nonces in PuTTY Client Exploitation Publi...

SUSE CVE-2024-3623

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. Th...

OESA-2024-1409 libreswan security update

Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

MinIO Privilege Escalation

Exploit Title: MinIO 2024-01-31T20-20-33Z - Privilege Escalation Date: 2024-04-11 Exploit Author: Jenson Zhao Vendor Homepage: https://min.io/ Software Link: https://github.com/minio/minio/ Version: Up to excluding RELEASE.2024-01-31T20-20-33Z Tested on: Windows 10 CVE : CVE-2024-24747 Required...

MinIO < 2024-01-31T20-20-33Z - Privilege Escalation Exploit

Exploit Title: MinIO 2024-01-31T20-20-33Z - Privilege Escalation Exploit Author: Jenson Zhao Vendor Homepage: https://min.io/ Software Link: https://github.com/minio/minio/ Version: Up to excluding RELEASE.2024-01-31T20-20-33Z Tested on: Windows 10 CVE : CVE-2024-24747 Required before execution:...

Apache Superset < 2.1.0 Hardcoded Secret Key

Apache Superset versions prior to 2.1.0 uses a default secret to sign cookies. An unauthenticated attacker can use this default value to forge a cookie and authenticate himself as administrator. No source data...

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in...

CVE-2024-3623

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. Th...

CVE-2024-3622

A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a...

Malicious code in @lbnqduy11805/congenial-octo-guide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f2f1e7f12097a4d36cf205e64bac66845c1b50b491e55e305944d68de0aa299 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1215 Malicious code in @lbnqduy11805/congenial-dollop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d1cb2d7d244fdb7219d86dee78afe5370e0de021b8cf06e5375753e33430d67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1224 Malicious code in @lbnqduy11805/potential-giggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a580421233df7644c976ffb287a35a86664f2926eb6790147cf917fe5ce6065 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1251 Malicious code in shuaishuaiqiang (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ac0c8f14a39bde6c27443c843a6185fa0e6ad3c0117eabe24eed2b276ff3336 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-3592

Name of the Vulnerable Software and Affected Versions Quay affected versions not specified Description A flaw was found in Quay when using mirror-registry to install it, where a default database secret key is used and stored in plain-text format in a configuration template file. This issue may le...

SUSE CVE-2020-36829

The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected...