Malicious code in send-orchestrator-event-lambda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3348279a1bc1471493fbd3415cdf02e1175ffa720b2c0df7fac42c1f7475b852 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8110 Malicious code in adidas-data-mesh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdd001e6013b356683b2fea45497d02787519396582fbe22102e0618a79380fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Impact The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is secp384r1. Using any other cur...

MAL-2023-8104 Malicious code in fca-dongsexx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e54ae0b20028a7237a5d5284fa6a3fbae917dbe46cee4724c495d3e413eb0279 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Leyka < 3.30.7.1 - Subscriber+ Sensitive Information Disclosure

Description The plugin is vulnerable to Sensitive Information Exposure via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more...

CVE-2023-4917

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

Design/Logic Flaw

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

CVE-2023-4917 Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

GHSA-MJQH-V5F2-G2MW Apache Airflow information exposure vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

Apache Airflow information exposure vulnerability

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

CVE-2023-40712

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

Design/Logic Flaw

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

CVE-2023-40712 Apache Airflow: Secrets can be unmasked in the "Rendered Template"

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

Malicious code in xweb_3.0_component_lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f6b7e56dbb18ea6a0d7b22a4334b7303140d6c041322360074890df204e941a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-31087 · WordPress · Leyka

Name of the Vulnerable Software and Affected Versions: Leyka plugin for WordPress versions up to, and including, 3.30.3 Description: The issue allows authenticated attackers with subscriber-level permissions or above to extract sensitive data, including Sberbank API key and password, PayPal Clien...

GHSA-FWR2-64VR-XV9M Argo CD cluster secret might leak in cluster details page

Impact Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. https://github.com/argoproj/argo-cd/pull/7139 introduced the ability to manage cluster labels and...

MAL-2023-8070 Malicious code in discord.js-selfv20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 415451606140d30857fac1d188c1baac785f90d3fcdc2f66e34743e59ce91628 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Insecure Default Initialization of Resource in Apache Superset

CVE-2023-27524: Apache Superset Auth Bypass and RCE Apache Su...

CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

Cisco Identity Services Engine RADIUS DoS (cisco-sa-ise-radius-dos-W7cNn7gt)

According to its self-reported version, Cisco Identity Services Engine RADIUS Denial of Service is affected by a vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine ISE, that could allow an unauthenticated, remote attacker to cause the affected system to stop...