CVE-2023-3361

A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster ds pipeline server and saves them in plain text in the generated output instead of an ID for a Kubernetes secret...

Design/Logic Flaw

A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster ds pipeline server and saves them in plain text in the generated output instead of an ID for a Kubernetes secret...

CVE-2023-3361 S3 credentials included when exporting elyra notebook

A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster ds pipeline server and saves them in plain text in the generated output instead of an ID for a Kubernetes secret...

CVE-2023-3361 S3 credentials included when exporting elyra notebook

A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster ds pipeline server and saves them in plain text in the generated output instead of an ID for a Kubernetes secret...

Malicious code in vtuan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f8cf6a272ede67beef66b26fb6e1faf36a30352a41373528b95a7919295bf2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in playwright-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44aadbfa206dce3a9b475d92ce277e6db2e0b0e1d8a3781be36355ea3ad4cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Insufficiently Protected Credentials

github.com/schollz/croc is vulnerable to sensitive information disclosure via Insufficiently Protected Credentials. The vulnerability is due to when users specify a custom shared secret via the command line, as it becomes visible on the host's process list for all local users. This can lead to...

Sensitive Information Exposure

github.com/schollz/croc is vulnerable to Sensitive Information Exposure. The vulnerability is due to the way croc uses the leading three characters of a shared secret to select a common "room name". When custom shared secrets are used, the leading three characters might give away information abou...

Malicious code in starcoffe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21d2d2d622bacbbb48186877f4de201e3ef7466ac586b34502e7df3b1dfc5e37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ktarco1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e3f2253e55d0e67c351fbfa882017f51f5575f1488573afd9ee2b83e277be23 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thinh2001-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f8d03b386fe1014644e4170699db11a1fccd1cec5639a5e99ac272d9fd12c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8237 Malicious code in gradient-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7856f4d5db8c9074c3633d2d5a61782c18536a58a84cb8ad56ae029525880875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-get (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19e0a51fdb1bf06bf1cf80981823698ed77398aeef31127fbab3fcfb0a3f2e01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-43784

Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there is no security threat...

Plesk Onyx Security Vulnerability

Plesk Onyx is a hosting control panel from Plesk Switzerland. A security vulnerability exists in Plesk Onyx version 17.8.11 that stems from a security issue with the accessKeyId and SecretAccessKey fields associated with the Amazon AWS Firehose component...

Malicious code in @zettle-bo/react-router-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d15f8bb2c4ca588ab243f077851d021201eb274122b32a38b91cc93d7d03d1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zettle-bo/routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5aa58a36545bf3bfb7acfdee7ca0ccfeef15bb87c3e2c31651f41e8fa9070026 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zettle-bo/bootstrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 348b20a3785062502338cff3dc24b6f6ed6d517924be7055ceb59e444232a7cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-28982 · Plesk +1 · Plesk Onyx +1

Name of the Vulnerable Software and Affected Versions: Plesk Onyx version 17.8.11 Description: The issue is related to the presence of accessKeyId and secretAccessKey fields in the Amazon AWS Firehose component. However, the vendor's position is that there is no security threat. Recommendations:...

SUSE CVE-2023-43617

An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...