Malicious code in wcc-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e55bf83a3393a668485fec2cbcb072ee078657ab4b98b80e3debd7ec3fb83057 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

K000134748: Kubernetes vulnerabilities CVE-2019-1002100, CVE-2019-11254, CVE-2017-1002101, and CVE-2017-1002102

Security Advisory Description CVE-2019-1002100 In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" e.g. kubectl patch --type json or "Content-Type:...

The Rising Threat of Secrets Sprawl and the Need for Action

The most precious asset in today's information age is the secret safeguarded under lock and key. Regrettably, maintaining secrets has become increasingly challenging, as highlighted by the 2023 State of Secrets Sprawl report, the largest analysis of public GitHub activity. The report shows a 67%...

This Week in Spring - May 23rd, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 23rd and, famously, nothing major has happened in the last week OH WAIT WE RELEASED SPRING BOOT 3.1! Have you checked it out yet? It's dope. I did a Spring Tips installment looking at some of its features here that y...

ginuerzh/gost vulnerable to Timing Attack

Timing attacks occur when an attacker can guess a secret by observing a difference in processing time for valid and invalid inputs. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparision function. More information on this attack type can ...

Malicious code in standforusz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38e449c44fbf714a06802408135b28a615f92b1821aa601f9fa6e14f60f8f832 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-809 Malicious code in standforusz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38e449c44fbf714a06802408135b28a615f92b1821aa601f9fa6e14f60f8f832 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-23965 · Gost · Gost

Name of the Vulnerable Software and Affected Versions: gost GO Simple Tunnel affected versions not specified Description: The issue arises from the comparison of untrusted input, sourced from an HTTP header, with a secret using a non-constant time comparison function. This allows an attacker to...

Nextcloud: App stores client secret unencrypted in database

The client secret used to identify the Nextcloud server was stored in plain text in the database, making it vulnerable to unauthorized access...

Malicious code in buffer-ex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 279833dce3a99cfad24c4d603dda5c3b4ed443d44d280456c73eee2a270a3f5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fotkakukur (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9d31f7505c558cdd72721d54399f7370b937aeddcb487bb93364f35623aff3bd Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

AlmaLinux 9 : edk2 (ALSA-2023:2165)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2165 advisory. - Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. CVE-2021-38578 - A timing based side channel exists in t...

MAL-2023-167 Malicious code in cfa-styleguide (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5562a6cb1d5f239216be52c28e8d316e8ffe0f490d11978863202a6fcfcbe8bc Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Malicious code in flying_pusher (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9091b084b192777c6cbacc1b67d67b879e2cdceda2b68082e975394f648cac68 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

CVE-2023-32303

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in...

Design/Logic Flaw

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in...

PYSEC-2023-71

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in...

Planet's secret file is created with excessive permissions

Impact The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but its permissions allowed the user's group and non-group to read the file as well. Validation Check the permissions on the secret file with ls -l /.planet.json and ensure th...

GHSA-J5FJ-RFH6-QJ85 Planet's secret file is created with excessive permissions

Impact The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but its permissions allowed the user's group and non-group to read the file as well. Validation Check the permissions on the secret file with ls -l /.planet.json and ensure th...

CVE-2023-32303 Planet's secret file is created with excessive permissions

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in...