Malicious code in vue-cli-plugin-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb4c725718310cb969ec6171fad585bea2b58fc7d4460be6b706cb8529356d7a The OpenSSF Package Analysis project identified 'vue-cli-plugin-lint-staged' @ 9.9.7 npm as malicious. It is considered malicious because: - The...

MAL-2024-11893 Malicious code in vue-cli-plugin-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb4c725718310cb969ec6171fad585bea2b58fc7d4460be6b706cb8529356d7a The OpenSSF Package Analysis project identified 'vue-cli-plugin-lint-staged' @ 9.9.7 npm as malicious. It is considered malicious because: - The...

CVE-2024-38499: Improper Privilege Management

CA Client Automation ITCM allows non-admin/non-root users to encrypt a string using CAF CLI and SDACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to...

Directory Traversal

The github.com/cli/cli is vulnerable to a Directory Traversal. The vulnerability is due to improper handling of artifact names during download when using the gh run download command. Specifically, if a malicious GitHub Actions workflow artifact is named .., the files within the artifact are...

dropbear:fuzzer-kexsntrup-cli: Crash in mp_count_bits

Project: https://secure.ucc.asn.au/hg/dropbear https://github.com/mkj/dropbear.git Detailed Report: https://oss-fuzz.com/testcase?key=4592162058076160 Project: dropbear Fuzzing Engine: afl Fuzz Target: fuzzer-kexsntrup-cli Job Type: aflasandropbear Platform Id: linux Crash Type: UNKNOWN READ Cras...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=7.6.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=7.4.5) +272 more potentially affected by CVE-2024-55887 via org.fhir:ucum (>=1.0.1, <=1.0.8)

org.fhir:ucum MAVEN version =1.0.1, =4.0.0, =5.6.5, =4.1.0, =4.1.0, =4.0.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.4.0, =5.3.0, =7.6.1 and more Source cves: CVE-2024-55887 Source advisory: GHSA-W9J7-PHM3-F97J...

CVE-2024-36623 affecting package moby-cli for versions less than 24.0.9-5

CVE-2024-36623 affecting package moby-cli for versions less than 24.0.9-5. A patched version of the package is available...

BIT-PYTHON-2024-9287 Virtual environment (venv) activation scripts don't quote paths

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means that...

Remote Code Execution (RCE)

GitHub CLI is vulnerable to Remote Code Execution RCE. The vulnerability is due to unvalidated SSH connection details, allowing a malicious devcontainer to inject arguments that execute arbitrary commands when using gh codespace ssh or gh codespace logs...

SUSE CVE-2024-53858

The gh cli is GitHub's official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

Malware in appetize-cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@coze-arch/cli (>=0.0.36-alpha.0a210b, <=0.1.9), @hakimedes/dsh-easyremote (>=0.2.5, <=0.3.4) +5 more potentially affected by CVE-2024-53866 via pnpm (>=9.0.0, <=9.14.4)

pnpm NPM version =9.0.0, =0.0.36-alpha.0a210b, =0.2.5, =2.25.6, =0.1.2, =1.4.0, =2.0.0, =26.1.4 Source cves: CVE-2024-53866 Source advisory: GHSA-VM32-9RQF-RH3R...

CVE-2024-54008

An authenticated Remote Code Execution RCE vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host...

PT-2024-10808

Name of the Vulnerable Software and Affected Versions RUGGEDCOM ROX MX5000 versions prior to V2.16.0 RUGGEDCOM ROX MX5000RE versions prior to V2.16.0 RUGGEDCOM ROX RX1400 versions prior to V2.16.0 RUGGEDCOM ROX RX1500 versions prior to V2.16.0 RUGGEDCOM ROX RX1501 versions prior to V2.16.0...

CVE-2020-28398: Cross-Site Request Forgery (CSRF)

A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...

CVE-2024-54008: Improper Neutralization of Special Elements used in an OS Command

An authenticated Remote Code Execution RCE vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host...

MAL-2024-11486 Malicious code in vue-cli-plugin-changelog (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vue-cli-plugin-changelog (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in appetize-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c31f44a5dab1f6af3da9463b68db6380a0a280ac35c3d3051f96c24f87c7821e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11235 Malicious code in appetize-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c31f44a5dab1f6af3da9463b68db6380a0a280ac35c3d3051f96c24f87c7821e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...