CVE-2023-32303 Planet's secret file is created with excessive permissions

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in...

Insecure Randomness

github.com/cloudflare/circl is vulnerable to Insecure Randomness. Kyber and FrodoKEM did not check whether crypto/rand.Read returned an error, leading to a predictable shared secret. The tkn20 and blindrsa components did not check if enough randomness was returned from the user provided randomnes...

Information Disclosure

@mittwald/kubernetes is vulnerable to information disclosure. The vulnerability exists in client.ts when debug logging is enabled which allows an attacker to get access to secret contents leaked via debug logging...

MAL-2023-46 Malicious code in @nokia-csf-uxr/csfwidgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39bbff0400a8d8025c9c214e1a4412729bd69e23c231e3307d61d05b54f8eb72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-2Q89-485C-9J2X Improper random reading in CIRCL

Impact When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did...

Improper random reading in CIRCL

Impact When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did...

GitHub Extends Push Protection to Prevent Accidental Leaks of Keys and Other Secrets

GitHub has announced the general availability of a new security feature called push protection , which aims to prevent developers from inadvertently leaking keys and other secrets in their code. The Microsoft-owned cloud-based repository hosting platform, which began testing the feature a year ag...

GitHub Extends Push Protection to Prevent Accidental Leaks of Keys and Other Secrets

GitHub has announced the general availability of a new security feature called push protection, which aims to prevent developers from inadvertently leaking keys and other secrets in their code. The Microsoft-owned cloud-based repository hosting platform, which began testing the feature a year ago...

Malicious code in xml2binary (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8d6e59c6cb9fb2059b390b3b3677b1be1d9eedbe9f78b8ffa2794d5483e2d6d4 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Malicious code in river-of-love-audiobook-the-bradens-at-peaceful-harbor-3-the-bradens-15-love-in-bloom-34-by-melissa- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f52860f6d056fb8f0e643076dd2ac0cd59a481d3d6b32eb033453f716f1e4eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-501 Malicious code in hit-makers-the-science-of-popularity-in-an-age-of-distraction-by-derek-thompson-on-ipad-new-version- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 076db454192ff726a44259a97efbfa7696d32887045af6be417937ffc98f5537 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in born-of-water-elemental-origins-1-by-al-knorr-online-full-volumes- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13ed688a98ceec7189e73832c965d435ff1c7495d8acb4df863273d491b6a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-283 Malicious code in dow-load-the-subtle-art-of-not-giving-a-fck-a-counterintuitive-approach-to-living-a-good-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 527f0e66b104b58627e027e919a30c118c48facef44c3592f55dbca769014d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Design/Logic Flaw

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

CVE-2023-1732 Improper random reading in CIRCL

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

CVE-2023-1732 Improper random reading in CIRCL

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

CVE-2023-1732 Improper random reading in CIRCL

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

kernel: mm/secretmem: fix panic when growing a memfd_secret

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix panic when growing a memfdsecret When one tries to grow an existing memfdsecret with ftruncate, one gets a panic 1. For example, doing the following reliably induces the panic: fd = memfdsecret; ftruncatefd, 10;...

Malicious code in discord-sp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32f41fb60beb906f09872435c3ee0bdf7290d56df0a8cf1a097f7416ce1b898c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-533 Malicious code in jannah-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe2e022fa0d4963c4945c12a0fb8f17cf529cb3c9ce770ecfc85481cd3508e98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...