4934 matches found
Malicious code in grammy-utils (npm)
This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 722622ea790d1aa9a24e9418f5f3480a09e5501b039fa8256d60bba00291e894 Any computer that has this package installed or...
PT-2025-3753 · Zoom · Zoom Workplace Apps
Name of the Vulnerable Software and Affected Versions: Zoom Workplace Apps affected versions not specified Description: The issue is related to an out-of-bounds write in some Zoom Workplace Apps, which may allow an authorized user to conduct a loss of integrity via network access. Recommendations...
Apache Hive vulnerable to Observable Timing Discrepancy and Authentication Bypass by Spoofing
Use of Arrays.equals in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0,...
CVE-2024-23953
Use of Arrays.equals in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0,...
CVE-2024-23953 Apache Hive: Timing Attack Against Signature in LLAP util
Use of Arrays.equals in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0,...
CVE-2024-23953
CVE-2024-23953 affects Apache Hive (LLAP); uses Arrays.equals() in LlapSignerImpl to compare signatures, introducing a timing discrepancy that can enable signature forgery by an authorized user. The issue stems from non-constant-time comparison, where mismatched bytes may reveal information throu...
PT-2025-2366 · Apache · Apache Hive
Name of the Vulnerable Software and Affected Versions: Apache Hive versions prior to 4.0.0 Description: The issue arises from the use of Arrays.equals in LlapSignerImpl to compare message signatures, allowing an attacker to forge a valid signature for an arbitrary message byte by byte. This can...
SUSE CVE-2024-10846
The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...
AZL-55947 CVE-2024-10846 affecting package docker-compose for versions less than 2.27.0-4
The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included...
compose-go 输入验证错误漏洞
compose-go is a Compose Specification open source reference library for parsing and loading Compose YAML files. A security vulnerability exists in compose-go that stems from an authorized user sending a malicious YAML payload causing compose-go to consume excessive memory and CPU cycles when...
CVE-2025-0515 Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update
The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmastershideadminnotice' function in all versions up to, and including,...
CVE-2024-55945 Cross-Site Request Forgery in DB Check Module in TYPO3
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...
GHSA-8CVQ-3JJP-PH9P Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability
Affected versions: - Apache Linkis Metadata Query Service JDBC 1.5.0 before 1.7.0 Description: In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read...
CVE-2024-45627
In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...
CVE-2024-45627 Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability
In Apache Linkis 1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...
Microsoft Purview Information Disclosure Vulnerability
A Server-Side Request Forgery SSRF vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network...
Microsoft Azure Marketplace SaaS 访问控制错误漏洞
Microsoft Azure Marketplace SaaS is a marketplace software from Microsoft Corporation USA. An access control error vulnerability exists in Microsoft Azure Marketplace SaaS that stems from improper access control and allows an authorized attacker to disclose information over the network...
PT-2025-25394
Name of the Vulnerable Software and Affected Versions Salt Master affected versions not specified Description The issue allows arbitrary event injection on the Salt Master. An authorized minion can use the master's minion event method to send arbitrary events onto the master's event bus...
CVE-2024-56512
CVE-2024-56512 (Apache NiFi) affects NiFi 1.10.0–2.0.0, where creating a new Process Group omits fine‑grained authorization checks for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers. As a result, authenticated users with permission to create Process Groups ...
