MAL-2024-11017 Malicious code in web-framework-addons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5274032fc0a53368c86dc7ddfbf044a3eaf831203e6b9f1df908fa32ba29050c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-JCGG-MG9G-P9WF Duplicate Advisory: Keycloak Build Process Exposes Sensitive Data

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7gv-xpgf-6395. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured...

Broadcom SANnav 安全漏洞

Broadcom SANnav is a suite of SAN management platforms from Broadcom Corporation USA. A security vulnerability exists in Broadcom SANnav versions prior to 2.2.2, which stems from the presence of information disclosure through a log file vulnerability, where configuration secrets are recorded in...

CVE-2024-52582

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-52582 cachi2 allows traceback prints locals

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-50378 Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

Important: Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update

An update for Openshift Jenkins is now available for Red Hat Product OCP Tools 4.14. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

MAL-2024-9316 Malicious code in 844b5t (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c94eb1a3b22cc1d70762d22b1b4267f152ebd42f59622a80427938d470e946ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9399 Malicious code in zip-mp3-a-lbum-do-wnload-new-coexist-l4rjg-vsisft (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbda29687ce05eceb8a7140f99fe1073db44c499a2817a3334aba733cda1eb29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2024-38862

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions 2.3.0p18, 2.2.0p35, 2.1.0p48 and =2.0.0p39 EOL causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators...

MAL-2024-9115 Malicious code in 0sxokg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8003ec05e6cd5bd8b902c112c898d9937aa19d167ed2d0cf3b33ffbcb41542f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-32800 · Unknown · @Backstage/Plugin-App-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-app-backend versions prior to 0.3.75 Description: The issue concerns the configuration supplied through APP CONFIG environment variables, where the visibility defined in the configuration schema is unexpectedly ignored. This...

MAL-2024-8910 Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8759 Malicious code in dwieuor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8cfca3d58e3997471c3ffd5e50d0d81b3d43d1af1d89e2a84d4bfc3f033f259 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8740 Malicious code in asowieo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b2426aa5e61b730fccaddcc53a450fcfb8f7e1ca4dfb450b6bf5848cccef12a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8771 Malicious code in hendeoir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fc0a4c45cc830a7151b688c058b945f36100df53a7f66c505be30025dfcf391 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD

Impact The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost BMH CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespac...

PT-2024-30671 · Unknown +1 · Baremetal Operator +2

Name of the Vulnerable Software and Affected Versions: baremetal-operator versions prior to 0.8.0 baremetal-operator versions prior to 0.6.2 baremetal-operator versions prior to 0.5.2 Description: The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The...

MAL-2024-8373 Malicious code in @diotoborg/ipsa-magni-debitis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dd2fe1ad636ad48e60e63682fb9cd8500630f7254400236df9ded9104afbc03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8491 Malicious code in @diotoborg/odio-architecto-ut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 242e04cb7795a593bc209c4272c33abdcdc2ad9b903f569de9d57c019e6eef9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...