Malware in vss-web-auth-client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5971 Malicious code in vss-web-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70dc7c0837db09d1f3b1d98483b9ce346b56d8ea5ae46ee6b2d974d8be75ea26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-29036

Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users shoul...

MAL-2024-6722 Malicious code in auth-client (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in auth-client (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys

Problem User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control. Solution Usin...

@bundly/ic-core-js (>=0.1.0, <=0.4.2-rc.4), @bundly/ic-react (>=0.1.0, <=0.4.2-rc.4) +8 more potentially affected by CVE-2024-1631 via @dfinity/auth-client (>=0.20.2, <=0.21.4)

@dfinity/auth-client NPM version =0.20.2, =0.1.0, =0.1.0, =0.1.1, =0.0.1, =0.0.1, =0.0.3, =0.0.2, =0.0.38-next-2023-12-19, =0.0.1, =0.0.7 Source cves: CVE-2024-1631 Source advisory: OSV:GHSA-C9VV-FHGV-CJC3...

@bundly/ic-core-js (>=0.1.0, <=0.4.2-rc.4), @bundly/ic-react (>=0.1.0, <=0.4.2-rc.4) +8 more potentially affected by CVE-2024-1631 via @dfinity/auth-client (>=0.20.2, <=0.21.4)

@dfinity/auth-client NPM version =0.20.2, =0.1.0, =0.1.0, =0.1.1, =0.0.1, =0.0.1, =0.0.3, =0.0.2, =0.0.38-next-2023-12-19, =0.0.1, =0.0.7 Source cves: CVE-2024-1631 Source advisory: GHSA-C9VV-FHGV-CJC3...

@bundly/ic-core-js (>=0.1.0, <=0.4.2-rc.4), @bundly/ic-react (>=0.1.0, <=0.4.2-rc.4) +8 more potentially affected by CVE-2024-1631 via @dfinity/auth-client (>=0.20.2, <=0.21.4)

@dfinity/auth-client NPM version =0.20.2, =0.1.0, =0.1.0, =0.1.1, =0.0.1, =0.0.1, =0.0.3, =0.0.2, =0.0.38-next-2023-12-19, =0.0.1, =0.0.7 Source cves: CVE-2024-1631 Source advisory: MEND:CVE-2024-1631...

ai.foxpay.api:foxpay-sdk (>=1.0, <=1.1), ai.genauth:genauth-java-sdk (3.1.11) +2563 more potentially affected by CVE-2023-51075 via cn.hutool:hutool-core (>=5.0.0, <=5.8.23)

cn.hutool:hutool-core MAVEN version =5.0.0, =1.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =1.0.2, =1.0.4 and more Source cves: CVE-2023-51075 Source advisory: OSV:GHSA-7M7H-RGVP-3V4R...

yii2 security vulnerabilities

yii2 is a fast, secure and professional PHP framework. A security vulnerability exists in yii2-authclient versions prior to 2.2.15 that stems from vulnerability to cross-site request forgery CSRF attacks...

ai.foxpay.api:foxpay-sdk (>=1.0, <=1.1), ai.genauth:genauth-java-sdk (3.1.11) +2334 more potentially affected by CVE-2023-42276 via cn.hutool:hutool-core (>=5.0.0, <=5.8.21)

cn.hutool:hutool-core MAVEN version =5.0.0, =1.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =1.0.2, =1.0.4 and more Source cves: CVE-2023-42276 Source advisory: GHSA-RXGF-R843-G53H...

ai.foxpay.api:foxpay-sdk (>=1.0, <=1.1), ai.genauth:genauth-java-sdk (3.1.11) +2143 more potentially affected by CVE-2023-33695 via cn.hutool:hutool-core (>=5.0.0, <=5.8.18)

cn.hutool:hutool-core MAVEN version =5.0.0, =1.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =j8.2.2.0, =1.0.2, =1.0.4 and more Source cves: CVE-2023-33695 Source advisory: GHSA-7MCW-XMX3-7P8M...

Malicious code in @zeos-libs/auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee22ec16fe8410ba0fa17b116c3f3bc6c12ac2f37d88e9e81e5cc13ac891467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-793 Malicious code in @zeos-libs/auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee22ec16fe8410ba0fa17b116c3f3bc6c12ac2f37d88e9e81e5cc13ac891467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ai.houyi:dorado (>=0.0.1, <=0.0.8), ai.houyi:dorado-core (>=0.0.11, <=0.0.51) +11552 more potentially affected by CVE-2022-25845 via com.alibaba:fastjson (>=1.2.25, <=1.2.80)

com.alibaba:fastjson MAVEN version =1.2.25, =0.0.1, =0.0.11, =0.0.16, =0.0.1, =0.0.14, =0.0.47, =0.0.14, =0.1.1, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr2.sr1, =2.1.0 and more Source cves: CVE-2022-25845 Source advisory: GHSA-PV7H-HX5H-MGF...

ai.houyi:dorado (>=0.0.1, <=0.0.8), ai.houyi:dorado-core (>=0.0.11, <=0.0.51) +11552 more potentially affected by CVE-2022-25845 via com.alibaba:fastjson (>=1.2.25, <=1.2.80)

com.alibaba:fastjson MAVEN version =1.2.25, =0.0.1, =0.0.11, =0.0.16, =0.0.1, =0.0.14, =0.0.47, =0.0.14, =0.1.1, =j8.2.2.0, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr4, =j8.2.2.0, =finchley.sr2.sr1, =finchley.sr2.sr1, =2.1.0 and more Source cves: CVE-2022-25845 Source advisory: MEND:CVE-2022-2584...

ai.ylyue:yue-library-auth-client (2.1.0), ai.ylyue:yue-library-auth-service (2.1.0) +369 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.1.11.release)

org.springframework:spring-web MAVEN version 5.1.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ai.ylyue:yue-library-auth-client 2.1.0 - ai.ylyue:yue-library-auth-service 2.1.0 -...

ai.ylyue:yue-library-auth-client (>=j8.2.3.3, <=j11.2.3.3), ai.ylyue:yue-library-auth-service (>=j8.2.3.3, <=j11.2.3.3) +418 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.2.14.release)

org.springframework:spring-web MAVEN version 5.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ai.ylyue:yue-library-auth-client =j8.2.3.3, =j8.2.3.3, =j8.2.3.3, =j8.2.3.3, =j8.2.3.3,...

ai.ylyue:yue-library-auth-client (j11.2.6.1), ai.ylyue:yue-library-auth-service (j11.2.6.1) +3455 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.3.20)

org.springframework:spring-web MAVEN version 5.3.20 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ai.ylyue:yue-library-auth-client j11.2.6.1 - ai.ylyue:yue-library-auth-service j11.2.6.1 -...