MAL-2024-10559 Malicious code in embrace-helloworld (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27c1c70726566294b9958ec5ab9d3af0e2d5e1c3dc9451f07055c6b650bfbd50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10553 Malicious code in autolink-jira-issue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d899824dec6a9efaddf4482f495ca1b557fc0ec18d4371e0214c6397fd95ee71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2024-50185

In the Linux kernel, the following vulnerability has been resolved: mptcp: handle consistently DSS corruption Bugged peer implementation can send corrupted DSS options, consistently hitting a few warning in the data path. Use DEBUGNET assertions, to avoid the splat on some builds and handle...

CVE-2024-50177 drm/amd/display: fix a UBSAN warning in DML2.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since cursorwidth is explicity set to 0, this causes calculation logic to trigger overflow for an unsigned int triggering the kernel's UBSAN check as...

MAL-2024-10557 Malicious code in com.immutable.orderbook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f795b01833e389a9a9ebe458382a107659f9bcd99fc298823315bd263d617ff3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-35171

Name of the Vulnerable Software and Affected Versions Amazon Cognito affected versions not specified Description The issue allows previously authenticated users to continue executing authorized API requests until their authentication token expires, even after logging out. This is because...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from an integer overflow problem when a UBSAN warning is triggered...

MAL-2024-10556 Malicious code in com.immutable.api.zkevm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9abb9b0d7d0aaebe4c9072367919fa4d1ffdf77edb53d312432695954d05b599 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10560 Malicious code in immutable-axelar-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d36818770ca9a97d6b714a041348e2e44a341e8d2f017aff4fb1dc912d185e41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2024-50139

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix shift-out-of-bounds bug Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel. UBSAN: shift-out-of-bounds in arch/arm64/kvm/sysregs.c:1988:14 shift exponent 33 is too large f...

CVE-2024-50139 KVM: arm64: Fix shift-out-of-bounds bug

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix shift-out-of-bounds bug Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel. UBSAN: shift-out-of-bounds in arch/arm64/kvm/sysregs.c:1988:14 shift exponent 33 is too large f...

RHEL 8 : go-toolset:rhel8 (RHSA-2024:5077)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5077 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: net/http:...

CLSA-2024-1730919625 Fix CVE(s): CVE-2020-27773, CVE-2020-27775

SECURITY UPDATE: Integer overflow vulnerability in gem-private.h - debian/patches/CVE-2020-27773.patch: fix gamma calculation to prevent division by zero in ConvertLuvToXYZ function - CVE-2020-27773 SECURITY UPDATE: Undefined behaviour in quantum.h - debian/patches/CVE-2020-27775.patch: fix...

MAL-2024-10832 Malicious code in affinequant (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afe878283ed977f017256fda3c32fdd8efea0e4c50335d528933e9ea99dcf2a9 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-10491 Malicious code in tcms-malicious-package-test-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ecbe4f00487fb7bbadba6c2153a5c851ce1c61ce032ba09f3d69c53b49bd0f48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ALPINE-CVE-2024-9681

When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure HTTP:// scheme and perform transfers with host...

Malicious code in x2vmlgml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 83c3524199594df2a9cfa9a2fc3cb16b03e48c2e6abd67c8fc06b7a5d92d75dd A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

PT-2024-35592

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 6.6.65 Description A bug in the Linux kernel has been resolved, specifically in the vdpa: solidrun module. The issue arises in the psnet open pf bar and snet open vf bar functions, where a string is placed on the...

ABB Cylon Aspect 3.08.00 Off-By-One Vulnerability

A vulnerability was identified in a ABB Cylon Aspect version 3.08.00 where an off-by-one error in array access could lead to undefined behavior and potential denial of service. The issue arises in a loop that iterates over an array using a less than or equals to condition, allowing access to an...

MAL-2024-10386 Malicious code in tcms-malicious-package-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ecdca9c2ba1dc4fbd690b4af252ead04f9b81254e6951c5688da537a34156b45 The OpenSSF Package Analysis project identified 'tcms-malicious-package-test' @ 1.0.0 npm as malicious. It is considered malicious because: - Th...