Ubuntu: Security Advisory (USN-4817-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

@boomerang-io/gatsby-theme-boomerang (>=0.3.0-beta.0, <=1.4.2), @dcl/docs-site (>=1.0.0-3010867520.commit-1740972, <=1.0.0-20220919140413.commit-6dee65c) +5 more potentially affected by CVE-2023-22491 via gatsby-transformer-remark (>=5.4.0, <=5.23.1)

gatsby-transformer-remark NPM version =5.4.0, =0.3.0-beta.0, =1.0.0-3010867520.commit-1740972, =1.1.1, =1.18.5, =0.0.1, =0.1.1 - gatsby-starter-netlify-tailwind 1.1.0 Source cves: CVE-2023-22491 Source advisory: OSV:GHSA-7CH4-RR99-CQCW...

@arcgis/core (>=4.21.0-next.20210722, <=4.25.0-next.20220711), @archimedes/arch (>=2.1.1-beta.1, <=2.2.0) +184 more potentially affected by CVE-2023-22467 via luxon (>=2.0.1, <=2.5.0)

luxon NPM version =2.0.1, =4.21.0-next.20210722, =2.1.1-beta.1, =1.6.1-beta.1, =2.1.0-beta.1, =1.5.15, =0.1.0, =0.1.0, =0.0.0-nightly-2021101222132, =0.10.592-alpha, =0.14.1021, =3.0.1, =3.2.7-alpha.6226622763, =1.4.48, =1.4.50 and more Source cves: CVE-2023-22467 Source advisory:...

@0x4447/broccoli (>=1.0.0, <=1.0.16), @0x4447/potato (>=2.0.0, <=2.4.7) +424 more potentially affected by CVE-2021-4299 via string-kit (>=0.0.3, <=0.11.10)

string-kit NPM version =0.0.3, =1.0.0, =2.0.0, =1.0.0, =1.18.0, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =1.0.5-master.20190403074739, =1.0.0-M.5a, =0.1.0-master.20191109234452, =0.1.0-ipcrm-custom-event.20191122150318, =1.0.0-M.3, =1.2.2-master.20191206162119 - @atomist/sdm-pack-k8s...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.0), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=5.7.6) +64 more potentially affected by CVE-2022-22984 via snyk-python-plugin (>=1.0.0, <=1.24.0)

snyk-python-plugin NPM version =1.0.0, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =0.0.2, =0.0.11, =1.0.1 - @ericblade/quagga2-redux-middleware 1.0.1 and more Source cves: CVE-2022-22984 Source advisory:...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=6.1.0) +55 more potentially affected by CVE-2022-22984 via snyk-sbt-plugin (>=2.0.0, <=2.15.0)

snyk-sbt-plugin NPM version =2.0.0, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =0.0.2, =0.0.7, =0.2.0-a1, =0.2.8 and more Source cves: CVE-2022-22984 Source advisory: OSV:GHSA-4X6G-3CMX-W76R...

@appium/fake-driver (>=3.2.5, <=4.2.2), @barchart/marketdata-api-js (>=5.16.2, <=5.27.0) +76 more potentially affected by CVE-2022-39353 via @xmldom/xmldom (>=0.8.0, <=0.8.3)

@xmldom/xmldom NPM version =0.8.0, =3.2.5, =5.16.2, =1.0.0, =0.2.1-beta.36, =10.1.1, =1.0.0-alpha1, =0.0.101-beta.22, =1.0.0, =10.1.1, =4.0.0-beta.0, =4.0.0-beta.0, =1.0.2, =0.0.1, =1.0.0, =1.0.1, =2.2.0 and more Source cves: CVE-2022-39353 Source advisory: OSV:GHSA-CRH6-FP67-6883...

0xgank-tea-advice-pull (1.0.0), 0xgank-tea-balance-pencil (1.0.0) +8754 more potentially affected by CVE-2022-37599 via loader-utils (>=2.0.0, <=2.0.3)

loader-utils NPM version =2.0.0, =2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on loader-utils and may be impacted: - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 -...

@adobe/git-server (>=1.0.3, <=1.0.5), @adobe/helix-cli (>=5.9.3, <=6.1.0) +29 more potentially affected by CVE-2022-22984 +1 more via @snyk/snyk-cocoapods-plugin (>=2.0.1, <=2.5.2)

@snyk/snyk-cocoapods-plugin NPM version =2.0.1, =1.0.3, =5.9.3, =2.17.2, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.5.8, =0.0.2, =0.0.8, =0.2.0-a1, =1.20.0-alpha.11736.3, =2.3.2, =2.6.4 and more Source cves: CVE-2022-22984, CVE-2022-40764 Source advisory: SNYK:JS-SNYKSNYKCOCOAPODSPLUGIN-3038625...

PyPI Repository Warns Python Project Maintainers About Ongoing Phishing Attacks

The Python Package Index, PyPI, on Wednesday sounded the alarm about an ongoing phishing campaign that aims to steal developer credentials and inject malicious updates to legitimate packages. "This is the first known phishing attack against PyPI," the maintainers of the official third-party...

@akumzy/graphql-schema-generator (>=0.2.0, <=0.5.1), @appxdigital/appx-core (0.1.83) +444 more potentially affected by CVE-2022-35949 via undici (>=5.0.0, <=5.8.1)

undici NPM version =5.0.0, =0.2.0, =0.2.1, =0.2.11, =2.0.0, =1.6.0, =1.0.0, =0.2.0-beta.0, =1.0.0, =0.3.0, =0.3.21 and more Source cves: CVE-2022-35949 Source advisory: OSV:GHSA-8QR4-XGW6-WMR3...

CVE-2022-31175 Cross-site scripting caused by the editor instance destroying process in ckeditor5

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

3extensions (1.0.1), 4i18n-cli (>=0.0.2, <=0.0.7) +243 more potentially affected by CVE-2022-2596 via node-fetch (>=3.0.0, <=3.2.9)

node-fetch NPM version =3.0.0, =0.0.2, =0.0.1, =1.1.0, =1.273.2, =1.0.0, =1.0.0, =7.0.0, =1.0.11, =2.14.0, =1.0.0, =1.0.1 - @applitools/eyes-sdk-core 13.5.0 and more Source cves: CVE-2022-2596 Source advisory: OSV:GHSA-VP56-6G26-6827...

@adabra/ui-libs-grapesjs-mjml (>=0.0.122, <=0.0.139), @ant-extensions/page-maker (>=0.0.1, <=0.0.5) +44 more potentially affected by CVE-2022-21802 via grapesjs (>=0.10.8, <=0.18.4)

grapesjs NPM version =0.10.8, =0.0.122, =0.0.1, =1.0.6, =0.0.12, =2.0.18, =0.8.1-esbuild, =0.0.1, =1.0.3, =0.10.4, =22.0.8, =0.10.4-custom.0, =0.0.19, =0.1.5, =0.10.17, =1.0.8 and more Source cves: CVE-2022-21802 Source advisory: OSV:GHSA-589F-C66P-HXR4...

CentOS 8 : httpd:2.4 (CESA-2022:5163)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:5163 advisory. - httpd: modproxy NULL pointer dereference CVE-2020-13950 Note that Nessus has not tested for this issue but has instead relied only on the application's...

SUSE SLED15 / SLES15 Security Update : fwupd (SUSE-SU-2022:2322-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2322-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

@alexanderniebuhr/eslint-config (>=1.3.0, <=1.4.0), @alexanderniebuhr/style (>=1.1.0, <=1.3.0) +119 more potentially affected by CVE-2022-25875 via svelte (>=3.1.0, <=3.48.0)

svelte NPM version =3.1.0, =1.3.0, =1.1.0, =1.3.0, =0.7.7, =10.0.0, =7.1.4, =21.0.4, =8.0.4, =2.0.4, =1.0.1, =6.0.4, =5.0.2, =4.0.2, =1.0.1, =5.0.8, =12.0.48 and more Source cves: CVE-2022-25875 Source advisory: SNYK:JS-SVELTE-2931080...

@finsemble/finsemble-electron-adapter (>=7.0.0, <=7.0.1), @manniwatch/client-desktop (>=0.28.3, <=0.29.1) +9 more potentially affected by CVE-2022-29257 via electron (>=16.0.2, <=16.0.10)

electron NPM version =16.0.2, =7.0.0, =0.28.3, =0.0.1, =0.0.14, =0.0.15, =2.0.56, =1.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.3 Source cves: CVE-2022-29257 Source advisory: OSV:GHSA-77XC-HJV8-WW97...

@finsemble/finsemble-electron-adapter (>=7.0.0-beta.2, <=7.0.1), @manniwatch/client-desktop (>=0.28.3, <=0.29.1) +9 more potentially affected by CVE-2022-29247 via electron (>=16.0.2, <=16.2.3)

electron NPM version =16.0.2, =7.0.0-beta.2, =0.28.3, =0.0.1, =0.0.14, =0.0.15, =2.0.56, =1.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.3 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

@koj/strapi (>=0.0.0, <=1.4.3), @psworld/backend_project (0.0.1) +7 more potentially affected by CVE-2022-30618 via strapi (>=3.0.0, <=3.6.8)

strapi NPM version =3.0.0, =0.0.0, =0.0.1, =1.1.0, =0.1.3, =0.3.0, =0.3.1 Source cves: CVE-2022-30618 Source advisory: OSV:GHSA-VGJ7-895J-GPR6...