MAL-2024-11841 Malicious code in graphql.vscode-graphql-syntax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a0d28da17294cea5d68bf358dd4576cf98bbc3d373b4add618e2c56ab5c18358 The OpenSSF Package Analysis project identified 'graphql.vscode-graphql-syntax' @ 99.99.99 npm as malicious. It is considered malicious because:...

MAL-2024-11836 Malicious code in action-mattermost-notify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff777c42ea9a589391478ecfd89da15137033e8ce5e0961b26f277f6e055c70e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11818 Malicious code in auth0-lock-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc8cb7c85f580c66397adec583bbd6623eafcb98683fcf6299ca73188892009f The OpenSSF Package Analysis project identified 'auth0-lock-webpack' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

MAL-2024-11872 Malicious code in casino-luzern-easter-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e48867ff5b177606a9ae5bcb27cf273c464b77b0ac518170e08739c0f3f8f80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in casino-luzern-easter-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e48867ff5b177606a9ae5bcb27cf273c464b77b0ac518170e08739c0f3f8f80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-9J3M-FR7Q-JXFW Beego has Collision Hazards of MD5 in Cache Key Filenames

In the context of using MD5 to generate filenames for cache keys, there are significant collision hazards that need to be considered. MD5, or Message Digest Algorithm 5, is a widely known cryptographic hash function that produces a 128-bit hash value. However, MD5 is no longer considered secure...

Beego has Collision Hazards of MD5 in Cache Key Filenames

In the context of using MD5 to generate filenames for cache keys, there are significant collision hazards that need to be considered. MD5, or Message Digest Algorithm 5, is a widely known cryptographic hash function that produces a 128-bit hash value. However, MD5 is no longer considered secure...

assimp:assimp_fuzzer: Bad-cast to Assimp::LogStream from Assimp::OptimizeMeshesProcess in CallbackToLogRedirector

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4521646748139520 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5be18c08e0b0 Crash State:...

CVE-2024-54100

Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally...

MAL-2024-11787 Malicious code in anumanu2324 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f4968a40c8a0664918114879119462d46034747809e1dfae1d03748017f9708 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Medium: python3.11-pip

Issue Overview: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to th...

CVE-2024-54100: Improper Input Validation

Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally...

PT-2024-36049

Name of the Vulnerable Software and Affected Versions: M3U8 module affected versions not specified Description: The issue is related to an out-of-bounds read vulnerability in the M3U8 module. Successful exploitation of this vulnerability may cause features to perform abnormally. Recommendations: ...

CVE-2024-54116: Improper Check for Unusual or Exceptional Conditions

Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally...

CVE-2024-47600

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the formatchannelmask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the...

MAL-2024-11782 Malicious code in @fandom-frontend/react-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7e9a17e9a163a67c876d4a9937c41e8711d220ae05d890281acec9edbf9986cf The OpenSSF Package Analysis project identified '@fandom-frontend/react-common' @ 100.100.106 npm as malicious. It is considered malicious...

MAL-2024-11781 Malicious code in @aoflmkt/is-desktop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7e1efcaba98a4db72e85c952c1936c99152081de71c2732e8189d9ad65390116 The OpenSSF Package Analysis project identified '@aoflmkt/is-desktop' @ 100.100.106 npm as malicious. It is considered malicious because: - The...

MAL-2024-11779 Malicious code in blacky-sheppoing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd5fabc8fe73f97f7fe5b3fc0d6bcb5d30d10325cdc85801ff4b38f51112d597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AZL-54221 CVE-2024-11053 affecting package cmake for versions less than 3.30.3-3

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but...

Malicious code in themes-vendor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c01e7f6fdbbed9b6db3db6a981479a8264b303dedb88de43a2b051db3b1e0498 The OpenSSF Package Analysis project identified 'themes-vendor' @ 0.0.3 npm as malicious. It is considered malicious because: - The package...