MAL-2023-8508 Malicious code in zoo-web-components-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a033ba4e84e9b29f5eb20d41c448241b24f20fb48b6ad382babb24543441f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8492 Malicious code in one-host-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10570e2e0d6b74ce5e35b8ef421caa58c28ba747ad01a79ef706e4b4c284ff5d The OpenSSF Package Analysis project identified 'one-host-i18n' @ 2.12.2 npm as malicious. It is considered malicious because: - The package...

De-risking in Practice: How Qualys Customers are Driving Value in Their Organizations

As the threat landscape continues to grow in complexity, it has become more important than ever for the modern enterprise to measure, communicate, and eliminate cyber risk with efficiency. What does that mean in practice? Over the last two days, during the 2023 Qualys Security Conference QSC taki...

MAL-2023-8422 Malicious code in bistrosk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 275abca8527ba6a0a29bf30537bad45fb01533a199b59ca9543da88dda4f8334 The OpenSSF Package Analysis project identified 'bistrosk' @ 200.0.3 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8390 Malicious code in @syska/aca-gui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c3f4460092e1b289ec60a15ed80e3a418d95fc95a42072bc38a787c9db2f5cf1 The OpenSSF Package Analysis project identified '@syska/aca-gui' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

[SECURITY] Fedora 38 Update: rust-aes-gcm-0.10.3-1.fc38

Pure Rust implementation of the AES-GCM Galois/Counter Mode Authenticated Encryption with Associated Data AEAD Cipher with optional architecture-specific hardware acceleration...

[SECURITY] Fedora 39 Update: rust-aes-gcm-0.10.3-1.fc39

Pure Rust implementation of the AES-GCM Galois/Counter Mode Authenticated Encryption with Associated Data AEAD Cipher with optional architecture-specific hardware acceleration...

Electrolink FM/DAB/TV Transmitter (controlloLogin.js) Credential Disclosure

Electrolink FM/DAB/TV Transmitter controlloLogin.js Credentials Disclosure Vendor: Electrolink s.r.l. Product web page: https://www.electrolink.com Affected version: 10W, 100W, 250W, Compact DAB Transmitter 500W, 1kW, 2kW Medium DAB Transmitter 2.5kW, 3kW, 4kW, 5kW High Power DAB Transmitter 100W...

Updated quictls packages fix security vulnerabilities

The updated packages fix security vulnerabilities: AES-SIV implementation ignores empty associated data entries. CVE-2023-2975 Excessive time spent checking DH keys and parameters. CVE-2023-3446 Excessive time spent checking DH q parameter value. CVE-2023-3817...

MAL-2023-8260 Malicious code in imagery_export (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ded43ce2e4a423411edd79212bce33e88313d38fa2930daa39e9a329ba99aa70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8107 Malicious code in payment-react-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1be5313ebc025cf120f74736aba05ea6e53d94fb39c36b1097c2803a7f7d70de The OpenSSF Package Analysis project identified 'payment-react-component' @ 1.5.0 npm as malicious. It is considered malicious because: - The...

Updated openssl packages fix security vulnerability

AES-SIV implementation ignores empty associated data entries. CVE-2023-2975 Excessive time spent checking DH keys and parameters. CVE-2023-3446 Excessive time spent checking DH q parameter value. CVE-2023-3817...

MAL-2023-8042 Malicious code in ccfedrtest-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis feab86ad551b54c16a189445e6ca91a8da0298130e49846935284822d9ebca1f The OpenSSF Package Analysis project identified 'ccfedrtest-poc' @ 1.0.3 npm as malicious. It is considered malicious because: - The package...

Medium: openssl

Issue Overview: Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-306)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-306 advisory. Issue summary: The AES-SIV cipher implementation contains a bug that causesit to ignore empty associated data entries which are unauthenticated asa consequence. Impact summary: Applications tha...

MAL-2023-1541 Malicious code in le-core-infra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bfbfa43ffabcf67af8f424825487f1ab613517f6605ccaf3a3d7f846b67221d7 The OpenSSF Package Analysis project identified 'le-core-infra' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1437 Malicious code in eslint-plugin-ironfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ddb571e2a90d22e958b983fe2578c4dc66915310367953568399aa68773cc77a The OpenSSF Package Analysis project identified 'eslint-plugin-ironfish' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

openSUSE 15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2023:3011-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3011-1 advisory. - CVE-2023-2975: Fixed AES-SIV implementation ignores empty associated data entries bsc1213383. - CVE-2023-3446: Fixed DHcheck excessive time with ov...

openSUSE 15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2023:3013-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3013-1 advisory. - CVE-2023-2975: Fixed AES-SIV implementation ignores empty associated data entries bsc1213383. - CVE-2023-3446: Fixed DHcheck excessive time with ov...

K000135633: OpenSSL vulnerability CVE-2023-2975

Security Advisory Description Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries ...