MAL-2022-4350 Malicious code in loblaws-mkt-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea14e6341d6cce727bc70b18f296d4597f68f72df8956aad5e7fe6adb92ff6f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in domestic-market-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da471213bbf63b13a1bc234f22ce43ce95a7b3e1e195a2af6487c525e75b9b4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2561 Malicious code in domestic-market-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da471213bbf63b13a1bc234f22ce43ce95a7b3e1e195a2af6487c525e75b9b4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mailru-toolkit-lego-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ad7f34dc30e8c7b2d7ac5ce792161ffaa94305473c6cbfc016f30ff1d89916b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4459 Malicious code in mailru-toolkit-lego-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ad7f34dc30e8c7b2d7ac5ce792161ffaa94305473c6cbfc016f30ff1d89916b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in odesk.bpa-tsf-calc-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 913d44e6393e1a341f574267f3a31fb22effca6602c910ed05a2274faf14437a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5022 Malicious code in odesk.bpa-tsf-calc-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 913d44e6393e1a341f574267f3a31fb22effca6602c910ed05a2274faf14437a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-FU-2022:2135-1 Feature update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Make sure SaltCacheLoader use correct fileclient bsc1199149 - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9...

SUSE-FU-2022:2042-1 Feature update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Make sure SaltCacheLoader use correct fileclient bsc1199149 - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9...

USN-5473-1 ca-certificates update

The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.50 version of the Mozilla certificate authority bundle...

GHSA-2CXG-448H-4WXJ Jenkins Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files

Jenkins Support Core Plugin did not validate the paths submitted for the "Delete Support Bundles" feature. This allowed users to delete arbitrary files on the Jenkins controller file system accessible to the OS user account running Jenkins. Additionally, this endpoint did not perform a permission...

GHSA-342C-F869-5M44 Apache Sling POST Servlets Denial of Service Vulnerability

The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service infinite loop via a crafted HTTP request...

GHSA-PW5C-XQF2-6XC2 Doctrine Security Misconfiguration Vulnerability

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local...

Cross-site Scripting (XSS)

contao/core-bundle is vulnerable to cross-site scriptingXSS attacks. The library does not properly sanitize the user inputs through the canonical tag, allowing an attacker to inject and execute malicious javascript...

Cross-site Scripting (XSS)

contao/core-bundle is vulnerable to cross-site scripting. The vulnerability exists in the prepare function of PageRegular.php, allowing an attacker to inject and execute malicious javascript through the canonical tags...

SUSE-SU-2022:1536-1 Security Beta update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 bsc1198556 - Fixes for Python 3.10 - Fix salt-ssh opts poisoning...

SUSE-SU-2022:1514-1 Security Beta update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 bsc1198556 - Fixes for Python 3.10 - Fix salt-ssh opts poisoning...

Important: Red Hat Security Advisory: OpenJDK 8u332 security update for Portable Linux Builds

The Red Hat build of OpenJDK 8 java-1.8.0-openjdk is now available for portable Linux. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

The vulnerability of the SyliusGridBundle e-commerce platform for Symfony applications, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary SQL queries.

The vulnerability of the SyliusGridBundle e-commerce platform for Symfony applications is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries remotely...

SQL Injection

sylius/grid-bundle is vulnerable to SQL Injection attacks. The library directly passes the values added at the end of query sorting to the database, allowing a malicious user to inject and execute arbitrary SQL queries on the system...