Malicious code in wlwz-2312-7007 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 054324edaf863762b0676dc56bb6ef9b8dfa5f3798e0f9815e1e4e01946d9f33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-239 Malicious code in wlwz-2312-0706 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d85151d20ccaefe4ec4a6dfaec7ecbe6ddb0a2a9d460165446f70458d49acd1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-2002 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef5a21b4890b9d34fdeab3641c6b164028928c6dff499835767120ab15120f45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-2001 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb822772f120d198707d10cbe559f4ca9b619834a479d71bd933c1fd19e71abc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-5801 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b3234257daa5c8033b618525328b2e40cba62c0b7cb6c0d6c74554f3f5f72e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-1306 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77d691b37721923600bfc7d3a91150d10b2362b93e2d147d5f56c1492ac7377e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-2000 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 470f83756bd0e14995c93ce4a19672c8af2854f0d9d1ffa7d80a7c79abd6e262 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-3808 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 803fde2c3a643704d2dea0d6332c867c4e254aaef1ff8807f785435bd52bce12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-170 Malicious code in wlwz-2311-2105 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64b0eb8568ce1a02816aadfce2d517ec5cd3945d96b4fb1e34e415a4ba25c42c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epsilonapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddfb4cbc67bdf6c16f4d91e84f6042e1f65a6adb6d1acca2975b483612aee913 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sample-schema-mgmt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4ef77c3bb30fb8fc7dc5c8e999eb9187db74dca1d1a5dc38068c32b54ae508b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apiv1-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b1e309b954dae134d52912053afde20e6d50386a7ee7487c082c8f0a026d3ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-0690

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLENOLOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as...

GHSA-C24V-8RFC-W8VW Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...

Timing Attack

github.com/kudelskisecurity/crystals-go is vulnerable to Timing Attack. The vulnerability is caused due to variations in the execution time of cryptographic algorithms, which allows an attacker to gain information about the secret key...

crystals-go vulnerable to KyberSlash (timing side-channel attack for Kyber)

Impact On some platforms, when an attacker can time decapsulation of Kyber on forged cipher texts, they could possibly learn parts of the secret key. Patches Patched in https://github.com/kudelskisecurity/crystals-go/pull/21 Note This library was written as part of a MsC student project in the...

Use Of Hard-Coded Credentials

@evershop/evershop is vulnerable to the Use Of Hard-Coded Credentials. The vulnerability is due to the exposure of a weak HMAC secret. Attackers can use the predictable secret to create valid JSON Web Tokens JWT, which allows them access to sensitive information...

MAL-2024-129 Malicious code in uptime-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a0e113f69232b20a00d710578e5aa983b5229e1eee46b549cecfd774a03e25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in colors-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67e4dcb786398ff89ed93f94d9221eaa6d94a42a7fe12838b8f5d743fcca7943 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Incorrect Authorization

openstack-keystone is vulnerable to Incorrect Authorization. The vulnerability is caused due to a flaw where only the first 72 characters of an application secret are verified. This allows attackers to bypass some password complexity which administrators may be counting on leading to compromising...