CVE-2023-1732 Improper random reading in CIRCL

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

kernel: mm/secretmem: fix panic when growing a memfd_secret

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix panic when growing a memfdsecret When one tries to grow an existing memfdsecret with ftruncate, one gets a panic 1. For example, doing the following reliably induces the panic: fd = memfdsecret; ftruncatefd, 10;...

Malicious code in discord-sp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32f41fb60beb906f09872435c3ee0bdf7290d56df0a8cf1a097f7416ce1b898c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-533 Malicious code in jannah-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe2e022fa0d4963c4945c12a0fb8f17cf529cb3c9ce770ecfc85481cd3508e98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-miscosoft-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83e19123a91cb7a1bd1e4a47d412e34e2235998c8bab60e33662f0fea42e1734 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-0b1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 538e1737bd9d1630e96258cbe6394221a1b70f79545cc2901cc29632155e4aa2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-561 Malicious code in kvs_availability_tool_registration_code_crack_work_zj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fc7a5cc09fe5fe0b8ab8a1d0956c0e8a7aad8a2ab6b582905796a1c333d67dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-582 Malicious code in marathi_chawat_katha_mck_comics_by_24_gw97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8f2db052000fc6063f23b25b1e074b2c97af8149bd18b477e91746e4b2b803a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in new_cracker_element_3d_after_effect_cs6_new_crack_dzr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc16e2fa8f77b7b5b69892932b891a79c37db955251c14795854110692e68963 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-96 Malicious code in animoto_full_version_portable_crack_rt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a2fb41229dbad8b492edfdbfb07c17b9bce5f61a6a00ae57d5483d13210b06d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Newspaper evades Russian censors, hides news in Counter-Strike map

A Finnish newspaper is making clever use of popular video game titles to promote press freedom and bypass Russian media restrictions regarding the invasion of Ukraine. The plan: Hide a secret room underneath a map, which players can stumble upon and see facts, figures, and photographs of whats be...

$10M Is Yours If You Can Get This Guy to Leave Russia

The U.S. government this week put a $10 million bounty on a Russian man who for the past 18 years operated Try2Check, one of the cybercrime undergrounds most trusted services for checking the validity of stolen credit card data. U.S. authorities say 43-year-old Denis Kulkovs card-checking service...

Buffer overflow

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cfconfirmExecTx in ethereumcontracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With...

CVE-2023-26089

European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5...

Authentication flaw

European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5...

GHSA-G35X-J6JJ-8G7J @mittwald/kubernetes's secret contents leaked via debug logging

Impact When debug logging is enabled via DEBUG environment variable, the Kubernetes client may log all response bodies into the debug log -- including sensitive data from Secret resources. When running in a Kubernetes cluster, this might expose sensitive information to users who are not authorise...

@mittwald/kubernetes's secret contents leaked via debug logging

Impact When debug logging is enabled via DEBUG environment variable, the Kubernetes client may log all response bodies into the debug log -- including sensitive data from Secret resources. When running in a Kubernetes cluster, this might expose sensitive information to users who are not authorise...

UBUNTU-CVE-2023-31207

Transmission of credentials within query parameters in Checkmk = 2.1.0p26, = 2.0.0p35, and = 2.2.0b6 beta may cause the automation user's secret to be written to the site Apache access log...

CVE-2023-31207 Automation user secret logged to Apache access log

Transmission of credentials within query parameters in Checkmk = 2.1.0p26, = 2.0.0p35, and = 2.2.0b6 beta may cause the automation user's secret to be written to the site Apache access log...

CVE-2023-31207 Automation user secret logged to Apache access log

Transmission of credentials within query parameters in Checkmk = 2.1.0p26, = 2.0.0p35, and = 2.2.0b6 beta may cause the automation user's secret to be written to the site Apache access log...