Malicious code in fca-chana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b37e708fb080fb543bd5fca9f8e273bf71bd0fb1744e3026ea3e491a298cf8e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-28878 · Croc · Croc

Name of the Vulnerable Software and Affected Versions: Croc versions prior to 9.6.16 Description: An issue was discovered in Croc where parts of a custom shared secret may be divulged to an untrusted Relay when composing a room name. This occurs when a custom shared secret is used. Recommendation...

PT-2023-28882 · Croc · Croc

Name of the Vulnerable Software and Affected Versions: Croc versions prior to 9.6.16 Description: An issue was discovered in Croc where the shared secret, located on a command line, can be read by local users who list all processes and their arguments. Recommendations: For Croc versions prior to...

MAL-2023-8157 Malicious code in thinhdz2001-fb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dab41a3de452cf2af66e9a0c6c82ff728a75a79b69bee1df9d834f6989e86134 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-reygie-harizon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b226744d0d61efb80f943c5fbb09b58cd8f8fb2fb1da081fad506086431e076f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eterscan-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76972c8bfc325e599147a978e53f2e7bfc86c4c32b85cf5dfc37247e4e650e79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hardhat-gas-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67fe0a38eab92ae516ffa0abcd348cd662325f6e1cb7ecd957bb2918d5aa7350 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in centurylink (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d96a2f3ad371aca3dc5bd6bf227819ee63ad00b7b1283b8280dd49497d8f8590 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8111 Malicious code in send-orchestrator-event-lambda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3348279a1bc1471493fbd3415cdf02e1175ffa720b2c0df7fac42c1f7475b852 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in send-orchestrator-event-lambda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3348279a1bc1471493fbd3415cdf02e1175ffa720b2c0df7fac42c1f7475b852 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8110 Malicious code in adidas-data-mesh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdd001e6013b356683b2fea45497d02787519396582fbe22102e0618a79380fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Impact The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is secp384r1. Using any other cur...

MAL-2023-8104 Malicious code in fca-dongsexx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e54ae0b20028a7237a5d5284fa6a3fbae917dbe46cee4724c495d3e413eb0279 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Leyka < 3.30.7.1 - Subscriber+ Sensitive Information Disclosure

Description The plugin is vulnerable to Sensitive Information Exposure via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more...

CVE-2023-4917

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

Design/Logic Flaw

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

CVE-2023-4917 Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

GHSA-MJQH-V5F2-G2MW Apache Airflow information exposure vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

Apache Airflow information exposure vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

CVE-2023-40712

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...