MAL-2023-1195 Malicious code in hellodependency2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17de73fdb52a6a236afb53cd11e4bbf4c7ceb88be0eae16c1a16561d102643b8 The OpenSSF Package Analysis project identified 'hellodependency2' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1089 Malicious code in @ms-atlas/datastudio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c1a0ed2d0fd6cab78604fbbbc988dcc649199fe0062a5ddff4a79dc1a8d9ef6 The OpenSSF Package Analysis project identified '@ms-atlas/datastudio' @ 0.1.21 npm as malicious. It is considered malicious because: - The...

MAL-2023-1206 Malicious code in icoreact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c03ec7b8267dc8690840c8f949e0a07962479ed8473f6c34782de1a1942aa507 The OpenSSF Package Analysis project identified 'icoreact' @ 30.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-41 Malicious code in @mendeley-internal/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bf5f20cb296d38e4859cdddfe26a5243135d149cd3f20f393a7a088c159110c Withdrawn Advisory This advisory has been withdrawn because it was generated erroneously. This link is maintained to preserve external references. Origin...

MAL-2023-1086 Malicious code in @mendeley-internal/react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4b3c54bd49a9cb3df935485579edbec49aa244d45e1a1f0535ceb9ee0c278871 The OpenSSF Package Analysis project identified '@mendeley-internal/react-ui' @ 100.0.1 npm as malicious. It is considered malicious because: -...

Using controlled delegatecall could in calling _deployTokenManager.tokenManagerDeploy()

Lines of code Vulnerability details Impact The use of delegatecall in this context poses a security risk. When using delegatecall, the called contract's code is executed within the context of the calling contract. This means that the deployTokenManager function is executed as if it is part of the...

MAL-2023-1088 Malicious code in @metronetinc/react-component-library-next-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d29aaa8c56838993a54df9b7ee45362f439f4b704ca467383c14f4643e2151a9 The OpenSSF Package Analysis project identified '@metronetinc/react-component-library-next-plugin' @ 9.999.8 npm as malicious. It is considered...

GHSA-F9G6-FP84-FV92 impl `FromMdbValue` for bool is unsound

The implementation of FromMdbValue has several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of...

CVE-2023-32001

A flaw was found in the curl package. This race condition modifies the behavior of symbolic link files in affected components which might be followed instead of overwritten when the condition is met, leading to undesired and potentially destructive behavior...

Important: golang

Issue Overview: The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules whi...

Critical Zero-Day Vulnerability in Citrix NetScaler ADC and NetScaler Gateway

On Tuesday, July 18, Citrix published a security bulletin warning users of three new vulnerabilities affecting NetScaler ADC and NetScaler Gateway. Of the three vulnerabilities, CVE-2023-3519 is the most severe—successful exploitation allows unauthenticated attackers to execute code remotely on...

MAL-2023-1097 Malicious code in @optalp/test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2be61ba56fbca0d8199a70e1257f274b56d233dfc2edd33b2fc29ab7b2a8446a The OpenSSF Package Analysis project identified '@optalp/test-package' @ 1.0.6 npm as malicious. It is considered malicious because: - The packa...

Malicious code in @marcomayo.com/firefly-shared-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a546d2e7e1826bee115fabca6b2802aab96ca9f227b6998e3ff64ca63459fc00 The OpenSSF Package Analysis project identified '@marcomayo.com/firefly-shared-js' @ 1.999.0 npm as malicious. It is considered malicious becaus...

MAL-2023-1259 Malicious code in openai-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4ae52243725fa671be1294e1a3747581764b2e74d9c499e0ac249b03676d0dbf The OpenSSF Package Analysis project identified 'openai-beta' @ 99.99.999 npm as malicious. It is considered malicious because: - The package...

MAL-2023-614 Malicious code in n-messaging-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a7dbe95def0d204c9533eba028f108451dd6ce16866266114b1cf2cd1cfb4c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2021-31294

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command specifically, a SET command. NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this...

SUSE CVE-2023-38200

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections...

MAL-2023-1199 Malicious code in hideorg-lvl (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cadb232e4b479810d217f2adbfed5e8dba555837082c21bb6fc0501c0686c462 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ossf-package-analysis...

CLSA-2023-1689259028 Fix CVE(s): CVE-2022-37452, CVE-2022-32546, CVE-2023-34151

SECURITY UPDATE: undefined behaviors of casting double to sizet in svg, mvg and other coders recurring bugs of CVE-2022-32546 - debian/patches/CVE-2023-34151.patch: properly cast double to sizet - CVE-2022-37452...

propose function Can lead to unexpected behavior

Lines of code Vulnerability details Impact Problème in the propose function, specifically in the construction of the targets, values, signatures, and calldatas arrays. These arrays are used to define the transactions that will be executed within the proposal, So the problem arises from the use of...