7387 matches found
MAL-2024-7494 Malicious code in sap-activity (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3e0a5149544b867f2487852926e46eba534638de827b17055beda04b632dbe63 The OpenSSF Package Analysis project identified 'sap-activity' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
PT-2024-5874 · Hashicorp +2 · Vault Enterprise +3
Name of the Vulnerable Software and Affected Versions: Vault and Vault Enterprise versions prior to 1.15.12 Vault and Vault Enterprise versions prior to 1.16.6 Vault and Vault Enterprise versions prior to 1.17.2 Description: The issue is related to the improper handling of requests originating fr...
MAL-2024-7439 Malicious code in sap-access (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1aa14a85de6a25c0c6ad3c4e767a216f5abbd057f79e6b296168df122fe6d7eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Code Issue Vulnerability in DAR-7000 at AUO Electronic Devices (Shanghai) Co.
DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. AUO Electronic Devices Shanghai Co. A code issue vulnerability exists in the DAR-7000, which stems from the file parameter of /log/decodmail.php being able to deserialize certain content. No details of the vulnerability are...
Malicious code in fake-package-agpl-license (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 53470e96107ebc806b1a440821244a335389aca112b5752ce995ae87150b0b4d The OpenSSF Package Analysis project identified 'fake-package-agpl-license' @ 1.0.0 npm as malicious. It is considered malicious because: - The...
RUSTSEC-2024-0442 Dump Undefined Memory by `JitDumpFile`
The unsound function dumpcodeloadrecord uses fromrawparts to directly convert the pointer addr and len into a slice without any validation and that memory block would be dumped. Thus, the 'safe' function dumpcodeloadrecord is actually 'unsafe' since it requires the caller to guarantee that the ad...
SUSE CVE-2024-39478
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer allocated in software stack. Calling kfree on it causes undefined behaviour in subsequent operations...
DEBIAN-CVE-2024-39482
In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btreeiter btreeiter is used in two ways: either allocated on the stack with a fixed size MAXBSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the...
CVE-2024-39478
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer allocated in software stack. Calling kfree on it causes undefined behaviour in subsequent operations...
DEBIAN-CVE-2024-39478
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer allocated in software stack. Calling kfree on it causes undefined behaviour in subsequent operations...
UBUNTU-CVE-2024-39478
In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer allocated in software stack. Calling kfree on it causes undefined behaviour in subsequent operations...
CVE-2024-39483 KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked When requesting an NMI window, WARN on vNMI support being enabled if and only if NMIs are actually masked, i.e. if the vCPU is already handling an NMI. KVM's ABI fo...
Linux kernel security vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the indexing of arrays beyond the bounds of dynamically sized iterators, leading to UBSAN complaints...
MAL-2024-7091 Malicious code in parser-7.0.0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 99ace32a9b913ac4a00ad574ac934c4eb6274d7c0cf3b948ced6b8191f511b68 The OpenSSF Package Analysis project identified 'parser-7.0.0' @ 4.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2024-7089 Malicious code in cra-docs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e49ccaa79a7296b7f1237beb3210cabf6610aab5c68e2c349b1fff4d3b2bb332 The OpenSSF Package Analysis project identified 'cra-docs' @ 7.999.45 npm as malicious. It is considered malicious because: - The package...
CVE-2024-36257 Lack of permission check when updating the profile picture of a remote user (shared channels enabled)
Mattermost versions 9.5.x = 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious...
CBL Mariner 2.0 Security Update: wget (CVE-2024-38428)
The version of wget installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-38428 advisory. - url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there M...
CVE-2024-6382
The CVE-2024-6382 issue affects the MongoDB Rust Driver: vulnerable in 2.0.x releases prior to 2.8.2. The root cause is incorrect handling of certain string inputs, which can cause the driver to construct unintended server commands. Impact described across sources includes unexpected application ...
Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2...