Democritus Project 代码问题漏洞

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A backdoor vulnerability exists in Democritus Project d8s-archives version 0.1.0, which stems from the presence of a potential code execution package democritus-file-system...

PT-2022-25834 · Pypi · D8S-Archives +1

Name of the Vulnerable Software and Affected Versions: d8s-archives version 0.1.0 Description: The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. Recommendations:...

CVE-2022-36066

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, admins can upload a maliciously crafted Zip or Gzip Tar archive to write files at arbitrary locations and trigger remote code execution...

Discourse 代码问题漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A file upload vulnerability exists in versions of Discourse prior to 2.8.9 and prior to 2.9.0.beta10, which stems from a lack of valid validation of uploaded files by the...

The vulnerability of the _zip_read_eocd64 function in the zip_open.c component of the Libzip library allows a attacker to cause a service failure.

The vulnerability of the zipreadeocd64 function in the zipopen.c component of the Libzip library library for working with Zip archives is related to the allocation of unlimited memory. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

sites.americanjewisharchives.org Cross Site Scripting vulnerability OBB-2938262

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

episcopalarchives.org Cross Site Scripting vulnerability OBB-2937127

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Arbitrary Code Execution

d8s-archives is vulnerable to arbitrary code execution. The vulnerability exists because the democritus-strings package of a specific version of d8s-archives acts as a potential code execution backdoor which allows an attacker to inject and execute malicious codes in to the system...

CVE-2022-38881

The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

PYSEC-2022-43074

The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

PYSEC-2022-43074

The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

d8s-archives (0.1.0), d8s-grammars (0.1.0) +5 more potentially affected by unknown CVE via democritus-strings (2021.1.28901)

democritus-strings PYPI version 2021.1.28901 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-strings and may be impacted: - d8s-archives 0.1.0 - d8s-grammars 0.1.0 - d8s-json 0.1.0 - d8s-math 0.1.0 - d8s-netstrings 0.1.0 - d8s-urls 0.1.0 -...

PYSEC-2022-43119

The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0...

d8s-archives (0.1.0), d8s-json (0.1.0) +4 more potentially affected by unknown CVE via democritus-file-system (2021.1.2701)

democritus-file-system PYPI version 2021.1.2701 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-file-system and may be impacted: - d8s-archives 0.1.0 - d8s-json 0.1.0 - d8s-pdfs 0.1.0 - d8s-urls 0.1.0 - d8s-utility 0.1.0 - d8s-yaml 0.1.0...

PT-2022-37382 · Pypi · D8S-Archives +1

Name of the Vulnerable Software and Affected Versions: d8s-archives version 0.1.0 Description: The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. Recommendations: For version...

PT-2022-37337 · Pypi · D8S-Archives +1

Name of the Vulnerable Software and Affected Versions: d8s-archives version 0.1.0 Description: The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. Recommendations: For version...

PT-2022-24606 · Pypi · D8S-Archives +1

Name of the Vulnerable Software and Affected Versions: d8s-archives version 0.1.0 Description: The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. Recommendations: For version...

Gamaredon APT targets Ukrainian government agencies in new campaign

By Asheer Malhotra and Guilherme Venere. Cisco Talos recently identified a new, ongoing campaign attributed to the Russia-linked Gamaredon APT that infects Ukrainian users with information-stealing malware. The adversary is using phishing documents containing lures related to the Russian invasion...

Fedora: Security Advisory for libtar (FEDORA-2022-44a20bba43)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:3139-1 Security update for clamav

This update for clamav fixes the following issues: clamav was updated to 0.103.7 bsc1202986 Upgrade the vendored UnRAR library to version 6.1.7. Fix logical signature 'Intermediates' feature. Relax constraints on slightly malformed zip archives that contain overlapping file entries...