Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...

UBUNTU-CVE-2023-50290

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designe...

MAL-2024-77 Malicious code in nylas-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f55a9a93c44b5c1883d56e29e04686d00c22261be8470feb04163ac33f285c41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-26886 · Epmm · Epmm

Name of the Vulnerable Software and Affected Versions: EPMM versions 11.8 through 11.10 Description: A security issue allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well ...

MAL-2023-8433 Malicious code in stripe-terminal-react-native-dev-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 148f318d6453b35d5563824a26fe185c3df7e96f1a4f12089adbbb556e867459 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-MQ6F-5XH5-HGCF Harbor timing attack risk

In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks. The vulnerability occurs due to the following code: https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.goL69-L69 To...

MAL-2023-8320 Malicious code in myaig-broker-portal-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fd67b15eabdced87c5fbe689d7e0c286991ac7bb879f2f2135f5f2538a4e549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8170 Malicious code in beta-fhr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b5c0dc188d59df05adaa6353780fdb2560fa0139c1aa05805c448337dc604a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8075 Malicious code in portal-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 768a95f370e1b55036ea06a3987092eb217f0a763c28953fcf3bb8c11fb0c580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3tool-rpc-methods (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e90705834b05e292cabf72529d908456c4f3768af2b34604147b5ac6ec38363 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1039 Malicious code in storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44e2fc216a94eece7f4dff23344c885f24361cb497ae18d6c7dde8ba3c4d39a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1012 Malicious code in ebtd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb50b8a351189eb3838b9913ca61e1c0b0c4269a04f5babe163cbe876380f77f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-87 Malicious code in all-in-one-web-header-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 686b3dfc4e5911c9132f822dba0217207a7b3da29e4b6be866a89dc2511f6309 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-392 Malicious code in fca-dongdev-remake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56a044be2fd2a7228afdd892e8a361e2f6531ca357252a66cbcea10716ec8c05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-24766 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.13.4 Description: The issue arises when Gateway API is enabled in Cilium, allowing an attacker on an affected cluster to leverage the absence of a check on the namespace in which a ReferenceGrant is created. This...

CVE-2023-34111 Command Injection Vulnerability in `Release PR Merged` Workflow in taosdata/grafanaplugin

The Release PR Merged workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of $ github.event.pullrequest.title in a bash command within the GitHub...

MAL-2023-365 Malicious code in fc-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7f4167da0bf5409b53f5b683dcdb962d93b6d03e2d9e3916c5859f78f8f9f1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-567 Malicious code in libponenunber-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a89a63696ce9e53ae77cca0d28b82c9f35f8641a17d0e39f74636ab6fb4fbe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Severe Flaw in Google Cloud's Cloud SQL Service Exposed Confidential Data

A new security flaw has been disclosed in the Google Cloud Platform's GCP Cloud SQL service that could be potentially exploited to obtain access to confidential data. "The vulnerability could have enabled a malicious actor to escalate from a basic Cloud SQL user to a full-fledged sysadmin on a...

CVE-2023-33264

In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets...