13097 matches found
BELL-CVE-2023-5158
Bulletin has no description...
Malicious code in optimize-procurement-and-inventory-with-ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d4a974419b1ab87d44f6d1c5cfd7fac97f037b476328f114d344113cf6bbd6f The OpenSSF Package Analysis project identified 'optimize-procurement-and-inventory-with-ai' @ 6.1.8 npm as malicious. It is considered maliciou...
MAL-2023-8191 Malicious code in @zettle-bo/bank-settings (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c565236f7920d5e91efa88abc8e86c0b09894525e980f20ca14654a57126c8b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
BELL-CVE-2023-4236
Bulletin has no description...
GHSA-364C-VVQX-446C vulnerabilities
Vulnerabilities for packages: croc...
Croc Security Breach
croc is a tool from the individual developers at Zack that allows any two computers to simply and securely transfer files and folders. A security vulnerability exists in Croc version 9.6.5 and earlier versions, which stems from a protocol that requires the sender to provide its local IP address...
CVE-2023-26143
Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the...
BELL-CVE-2023-4806
Bulletin has no description...
BELL-CVE-2023-4527
Bulletin has no description...
BELL-CVE-2023-43115
Bulletin has no description...
MAL-2023-8149 Malicious code in symbl_ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2a6d892c350f9034ac4cd7c1670b6b7a31f864e0ef2beeccfd53bb309336396 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2023-28342 · Vyper · Vyper
Name of the Vulnerable Software and Affected Versions: Vyper versions 0.2.9 through 0.3.9 Description: The issue concerns locks of the type @nonreentrant"" or @nonreentrant'' that do not produce reentrancy checks at runtime. This can be mitigated by ensuring the lock name is a non-empty string...
OSV-2023-867 Negative-size-param in http_cb
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62389 Crash type: Negative-size-param Crash state: httpcb fuzz.c...
BELL-CVE-2023-25585
Bulletin has no description...
PT-2023-26680 · Lapce · Lapce
Name of the Vulnerable Software and Affected Versions: Lapce version 0.2.8 Description: A race condition in Lapce allows an attacker to elevate privileges on the system. Recommendations: For Lapce version 0.2.8, at the moment, there is no information about a newer version that contains a fix for...
BELL-CVE-2023-4881
Bulletin has no description...
CVE-2023-4581
Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2...
CVE-2023-4577
When UpdateRegExpStatics attempted to access initialStringHeap it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2...
MAL-2023-8072 Malicious code in ethereum-cryptograph (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6e86c7c831c832fa4741a6ff20a38170abcd90a447a4a1902e53f4bdf06ae96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...