[SECURITY] Fedora 38 Update: fbthrift-2023.10.16.00-1.fc38

Thrift is a serialization and RPC framework for service communication. Thrift enables these features in all major languages, and there is strong support for C++, Python, Hack, and Java. Most services at Facebook are written using Thri ft for RPC, and some storage systems use Thrift for serializin...

[SECURITY] Fedora 37 Update: fbthrift-2023.10.16.00-1.fc37

Thrift is a serialization and RPC framework for service communication. Thrift enables these features in all major languages, and there is strong support for C++, Python, Hack, and Java. Most services at Facebook are written using Thri ft for RPC, and some storage systems use Thrift for serializin...

MAL-2023-8399 Malicious code in fbdebug (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2edf3045263e059e2b1599655b25cc167abecc4d1e77e5e7e8d62998b0fd9e18 The OpenSSF Package Analysis project identified 'fbdebug' @ 0.1 pypi as malicious. It is considered malicious because: - The package communicate...

CVE-2022-22466

IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 225222...

Hardcoded credentials

IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 225222...

MAL-2023-8394 Malicious code in npm-research-enum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32f39024ba535c374e98c41355c2663f4ae5a92ff25df3c0f8cc60837ec06d56 The OpenSSF Package Analysis project identified 'npm-research-enum' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

[SECURITY] Fedora 37 Update: python-asgiref-3.5.2-1.fc37

ASGI is a standard for Python asynchronous web apps and servers to communicate with each other, and positioned as an asynchronous successor to WSGI. This package includes ASGI base libraries, such as: Sync-to-async and async-to-sync function wrappers, asgiref.sync Server base classes,...

Malicious code in z-dsm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e2e8df0358f7f04a5b41981e5e7496d99d985f9e76087b0e3a233566f9ddfd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

IBM Security Verify Governance 信任管理问题漏洞

IBM Security Verify Governance is an intelligent identity access platform from International Business Machines IBM, Inc. provides organizations with a platform to analyze, define and control user access and access risk. IBM Security verify Governance suffers from a hard-coded vulnerability that...

Malicious code in ux-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1ed957b968f0d201b3698f9027b13297541196d608edb84f496f3262569e5a81 The OpenSSF Package Analysis project identified 'ux-website' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Commander - A Command And Control (C2) Server

Commander is a command and control framework C2 written in Python, Flask and SQLite. It comes with two agents written in Python and C. Under Continuous Development Not script-kiddie friendly Features Fully encrypted communication TLS Multiple Agents Obfuscation Interactive Sessions Scalable Base6...

AI and US Election Rules

If an AI breaks the rules for you, does that count as breaking the rules? This is the essential question being taken up by the Federal Election Commission this month, and public input is needed to curtail the potential for AI to take US campaigns even more off the rails. At issue is whether...

MAL-2023-8391 Malicious code in @banana-cake-pop/data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 62a20ff9ddb55a8de5c7bffe9455b25f0fca2223207e80cf7b9d7993bd02db12 The OpenSSF Package Analysis project identified '@banana-cake-pop/data' @ 1.9.10 npm as malicious. It is considered malicious because: - The...

Malicious code in @banana-cake-pop/data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 62a20ff9ddb55a8de5c7bffe9455b25f0fca2223207e80cf7b9d7993bd02db12 The OpenSSF Package Analysis project identified '@banana-cake-pop/data' @ 1.9.10 npm as malicious. It is considered malicious because: - The...

Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6173-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6173-1 advisory. Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local...

Apache HTTP Server Resource Management Error Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable, and extensible via a simple API. A resource management error vulnerability exists in Apache HTTP Server versions 2.4.55 through 2.4.57, which originates when an attacker...

Malicious code in @syska/aca-gui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c3f4460092e1b289ec60a15ed80e3a418d95fc95a42072bc38a787c9db2f5cf1 The OpenSSF Package Analysis project identified '@syska/aca-gui' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

Design/Logic Flaw

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

CVE-2023-34441 Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

CVE-2023-34441 Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...