PT-2024-32800 · Unknown · @Backstage/Plugin-App-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-app-backend versions prior to 0.3.75 Description: The issue concerns the configuration supplied through APP CONFIG environment variables, where the visibility defined in the configuration schema is unexpectedly ignored. This...

MAL-2024-8910 Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8759 Malicious code in dwieuor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8cfca3d58e3997471c3ffd5e50d0d81b3d43d1af1d89e2a84d4bfc3f033f259 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8740 Malicious code in asowieo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b2426aa5e61b730fccaddcc53a450fcfb8f7e1ca4dfb450b6bf5848cccef12a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8771 Malicious code in hendeoir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fc0a4c45cc830a7151b688c058b945f36100df53a7f66c505be30025dfcf391 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD

Impact The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost BMH CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespac...

PT-2024-30671 · Unknown +1 · Baremetal Operator +2

Name of the Vulnerable Software and Affected Versions: baremetal-operator versions prior to 0.8.0 baremetal-operator versions prior to 0.6.2 baremetal-operator versions prior to 0.5.2 Description: The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The...

MAL-2024-8373 Malicious code in @diotoborg/ipsa-magni-debitis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dd2fe1ad636ad48e60e63682fb9cd8500630f7254400236df9ded9104afbc03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8491 Malicious code in @diotoborg/odio-architecto-ut (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 242e04cb7795a593bc209c4272c33abdcdc2ad9b903f569de9d57c019e6eef9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8265 Malicious code in @diotoborg/dolorum-unde (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fddf262e0132df270971a1172fba3fbefd9e87973c91142ea50d208ec475f7bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8582 Malicious code in @diotoborg/quod-voluptatibus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9861e3b676c38749e1da1a41ecbfd64d5f6b70cb4455cb86dba9e2148ea9ee4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cilium 安全漏洞

Cilium is an open source software from Cilium Open Source. It is used to provide and transparently secure network connectivity and load balancing between application workloads, such as application containers or processes. A security vulnerability exists in Cilium versions 1.15.0 through prior to...

MAL-2024-7968 Malicious code in kiwoeslw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bae85e2f36251f9936fb3b965298a113bd8e3f92666f152e5882d69c935545bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Studio 42 elFinder vulnerable to Incorrect Access Control

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc...

CVE-2024-38909

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc...

CVE-2024-38909

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc...

CVE-2024-38909

Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc...

PT-2024-29277 · Unknown · Woodpecker

Name of the Vulnerable Software and Affected Versions: Woodpecker versions prior to 2.7.0 Description: The server allows any user to create and trigger malicious workflows, potentially leading to a host takeover or extraction of secrets normally provided to plugins. This issue can be exploited...

MAL-2024-7713 Malicious code in komcax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62c911bd41972a2fa3147e74bc8e6a7905d586c2f095b8190453f09f9250c613 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7720 Malicious code in stylesshert (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5cac694a4e67bb70870e3509a7d3944cb0cac1bad16defa2f01f1710d070b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...