Insecure Random Number Generator

lemur is vulnerable to an Insecure Random Number Generator. The vulnerability is due to the getpsuedorandomstring function in utils.py, caused to the usage of the insecure random library, which can result in authentication bypass in multiple services. The random library was used to generate the...

MAL-2023-1227 Malicious code in lime-web-component-interfaces (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 94eb9bf47469857d8b3e3da68a34e320a0c7b1129a7b260fafe36dea5396cc0c Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ossf-package-analysis...

ECDH Private Key Disclosure

ecdh is vulnerable to ECDH Private Key Disclosure. The vulnerability exists because the deriveSharedSecret function in index.js does not properly check if a point is on the curve, allowing an attacker to retrieve the derived shared secret...

PT-2023-22986 · Netflix · Netflix Lemur

Name of the Vulnerable Software and Affected Versions: Netflix Lemur versions prior to 1.3.2 Description: The issue is related to Netflix Lemur using insufficiently random values when generating default credentials. This may allow an attacker to guess the credentials and gain access to resources...

Malicious code in tsang-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b349833c412697b8091d1f61d201e3f3d2a4790697fb032342d7cf857782bbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-909 Malicious code in tsang-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b349833c412697b8091d1f61d201e3f3d2a4790697fb032342d7cf857782bbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

K000132686: TLS Triple Handshake Attack vulnerability

Security Advisory Description The original TLS protocol includes a weakness in master secret negotiation, potentially allowing the Triple Handshake Attack that is mitigated by the Extended Master Secret EMS extension defined in RFC 7627. Impact This vulnerability may allow an unauthenticated...

Remote Code Execution (RCE)

nautobot is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper sandboxing of environments for the Jinja2 template engine when used internally for template rendering for objects like extras.ComputedField,extras.CustomLink, extras.ExportTemplate, extras.Secret and...

CVE-2019-25105

A vulnerability, which was classified as problematic, was found in dro.pm. This affects an unknown part of the file web/fileman.php. The manipulation of the argument secret/key leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. Thi...

dro.pm 跨站脚本漏洞

dro.pm is an application by Luc Gommans personal developer. Used to remove links, text and files for easy sharing A cross-site scripting vulnerability exists in previous versions of dro.pm fa73c3a42bc5c246a1b8f815699ea241aef154bb, which stems from a security issue in the unknown section of the fi...

PT-2023-11363 · Dro.Pm · Dro.Pm

Name of the Vulnerable Software and Affected Versions: dro.pm affected versions not specified Description: A problematic issue was found in dro.pm, affecting an unknown part of the file web/fileman.php. The manipulation of the secret/key argument leads to cross-site scripting. It is possible to...

Malicious code in discord.js-lukyy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a156424566c5cc73cdef9a47310dbcfc44cf49533c5560b5fc21e1f1dedfa18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-P2HP-3WV3-4W74 ecdh vulnerable to Exposure of Resource to Wrong Sphere

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

ecdh vulnerable to Exposure of Resource to Wrong Sphere

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

CVE-2022-44310

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

Code injection

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

CVE-2022-44310

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

CVE-2022-44310

In Development IL ecdh before 0.2.0, an attacker can send an invalid point not on the curve as the public key, and obtain the derived shared secret...

The Secret Vulnerability Finance Execs are Missing

The Other Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd...

MAL-2023-47 Malicious code in @pagseguro/pagseguro-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8e3f853a167ac4fc6f37a0c3b1b12bdba5e57f568800476f319399643b6b0fa9 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...