MAL-2022-654 Malicious code in @tinkoff-react-bui/highlighter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f35ba0953c3d1b55af3ac66481e856e15f84300b58641282f67339e9fa1bbb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5531 Malicious code in purview-catalog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90b0032f8cf0b6d31990e681337cb6df917888cbf11cc64df4990956bdae3b5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-24876

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scriptin...

CVE-2022-31030 vulnerabilities

Vulnerabilities for packages: ctop...

GHSA-5FFW-GXPP-MXPF vulnerabilities

Vulnerabilities for packages: ctop...

MGASA-2022-0199 Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 4.3.4, which fixes several security vulnerabilities and other bugs which were corrected upstream...

GHSA-HP87-P4GW-J4GQ vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips, thanos-operator, thanos-operator-fips...

Malicious code in ual-content-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0e062a5264ae40c85a311a097fdae78c7ea205dd058a5f59f25859075c6c121 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-0611

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11...

GHSA-X5M6-JH4R-34MV Hub Package Arbitrary File Overwrite

The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file...

MGASA-2022-0049 Updated lrzsz packages fix security vulnerability

lrzsz before version 0.12.21rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a sizet to wrap around. CVE-2018-10195...

Command Injection in node-windows

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter...

Dolibarr has unspecified vulnerabilities

Dolibarr is an application. A modern software package that helps manage your organization's activities. a security vulnerability exists in Dolibarr, which stems from allowing HTML injection in admin limits.php in Dolibarr 7.0.2. No details of the vulnerability are currently available...

SUSE-SU-2021:4161-1 Security update for python-Babel

This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal that may lead to arbitrary locale files loading and arbitrary code execution bsc1185768...

Hitachi Energy PCM600 Update Manager

1. EXECUTIVE SUMMARY CVSS v3 6.7 Vendor: Hitachi Energy Equipment: PCM600 Update Manager Vulnerability: Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass the certificate validation and install an untrusted software...

Airangel Hsmx Gateway Remote Code Execution Vulnerability

Airangel Hsmx Gateway is a platform from Airangel UK, Inc. It is used to manage authentication and billing in the network.A remote code execution vulnerability exists in Airangel Hsmx Gateway prior to 5.2.04, which originates when a remote server controlled by an attacker downloads and runs a...

CVE-2021-23390

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set and U.get functions...

MGASA-2021-0290 Updated leptonica packages fix security vulnerabilities

Leptonica before 1.80.0 allows a denial of service application crash via an incorrect left shift in pixConvert2To8 in pixconv.c CVE-2020-36277. Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c CVE-2020-36278. Leptonica before 1.80.0 allows a heap-bas...

MGASA-2021-0261 Updated openssh packages fix a security vulnerability

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host CVE-2021-28041...

GHSA-P2J5-3F4C-224R Improper Input Validation in HashiCorp Consul

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. Specific Go Packages Affected github.com/hashicorp/consul/agent...