loader-utils: prototype pollution in function parseQuery in parseQuery.js

A prototype pollution vulnerability was found in the parseQuery function in parseQuery.js in the webpack loader-utils via the name variable in parseQuery.js. This flaw can lead to a denial of service or remote code execution...

loader-utils: prototype pollution in function parseQuery in parseQuery.js

A prototype pollution vulnerability was found in the parseQuery function in parseQuery.js in the webpack loader-utils via the name variable in parseQuery.js. This flaw can lead to a denial of service or remote code execution...

SUSE CVE-2023-2319

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 for PCS package, which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. Th...

loader-utils: regular expression denial of service in interpolateName.js

A flaw was found in the interpolateName function in interpolateName.js in the webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js. This flaw can lead to a regular expression denial of service ReDoS...

Critters cross-site scripting vulnerabilities

Critters is a GoogleChromeLabs open source Webpack plugin . Used to inline critical CSS and delay loading the rest. A security vulnerability exists in Critters versions 0.0.17-0.0.19. An attacker exploited the vulnerability to perform cross-site scripting attacks...

Malware in ynf-dx-webpack-plugins

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in ynf-dx-webpack-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ff33ef0f3340901bb0ce287a8b87f098654546d5b5883805533e7581670f64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Linux 9 : pcs (ELSA-2023-12595)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12595 advisory. 0.11.4-7 - Fix displaying differences between configuration checkpoints in pcs config checkpoint diff command - Fix pcs stonith update-scsi-devices...

MAL-2023-141 Malicious code in braze-webpack-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc71db731ac5e637112dcd53e9aef14f68b79db997c03e693ec04014b9178c76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in braze-webpack-sample

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in braze-webpack-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc71db731ac5e637112dcd53e9aef14f68b79db997c03e693ec04014b9178c76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

7niu-webpack-plugin (0.1.0), @a-brands/backend (>=1.0.0, <=1.0.4) +1164 more potentially affected by CVE-2020-26302 via is_js (>=0.2.1, <=0.9.0)

isjs NPM version =0.2.1, =1.0.0, =0.4.0-alpha.1, =0.1.0-beta.15, =0.3.0-beta.18, =0.1.0-alpha.10cbdf05, =1.0.1, =0.1.0, =1.0.5, =1.0.0, =3.10.1, =3.13.2 and more Source cves: CVE-2020-26302 Source advisory: OSV:GHSA-PVRW-G6FX-MCX2...

Security Bulletin: IBM Watson Assistant for Cloud pak for Data is affected by vulnerabilities in Webpack [CVE-2023-28154]

Summary Potential security bypass vulnerability in Webpack has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. IBM has addressed this vulnerability. Refer to details for additional information. CVE-2023-28154 Vulnerability Details CVEID:CVE-2023-28154 DESCRIPTION:...

Malicious code in wm-webpack-player-sri (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ce8f86b27a02853a91d351ebf67ea4c8b697d62b1c65c295b7a01cfa89148ec The OpenSSF Package Analysis project identified 'wm-webpack-player-sri' @ 0.0.71 npm as malicious. It is considered malicious because: - The...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary IBM has addressed multiple vulnerabilities in IBM Spectrum Discover. Webpack loader-utils CVE-2022-37601 is vulnerable to execute arbitrary code on the system caused by a pollution flaw in parseQuery function. OpenStack Keystone CVE-2021-3563 is vulnerable to bypass security restriction...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

Security Bulletin: IBM Edge Application Manager has a vulnerability listed in CVE 2023-28154. IBM has addressed this vulnerability.

Summary IBM Edge Application Manager 4.5 addresses the security vulnerability listed in CVE 2023-28154. Vulnerability Details CVEID:CVE-2023-28154 DESCRIPTION: Webpack could allow a remote attacker to bypass security restrictions, caused by the mishandling of the magic comment feature by the...

pcs security and bug fix update

An update is available for pcs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The pcs packages provide a command-line configuration system for the Pacemaker an...

CVE-2022-37599

A flaw was found in the interpolateName function in interpolateName.js in the webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js. This flaw can lead to a regular expression denial of service ReDoS. Mitigation Mitigation for this issue is either not available or the...

CVE-2023-2319

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 for PCS package, which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. Th...