MAL-2024-7423 Malicious code in dependent-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 70f70c2dd1e2fa144fb729148ad1259433561dcfc205e028a514ea1fc4c6a65a The OpenSSF Package Analysis project identified 'dependent-package' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

DEBIAN-CVE-2024-36041

KSmserver in KDE Plasma Workspace aka plasma-workspace before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the...

CVE-2024-3904

Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions "05" to "07" allows a local attacker to execute arbitrary code by saving a malicious file to a specific folder. As a result, the attacker may disclose, tampe...

CVE-2024-3904

CVE-2024-3904 affects Mitsubishi Electric MELIPC Series MI5122-VW firmware versions 05–07. Root cause: Incorrect Default Permissions (CWE-276) enables a local attacker to execute arbitrary code by saving a malicious file to a specific folder. Impact per sources: disclosure/tampering/destruction o...

CVE-2024-3904

Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions "05" to "07" allows a local attacker to execute arbitrary code by saving a malicious file to a specific folder. As a result, the attacker may disclose, tampe...

CVE-2024-3904

Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions "05" to "07" allows a local attacker to execute arbitrary code by saving a malicious file to a specific folder. As a result, the attacker may disclose, tampe...

Malicious code in addcriteria (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c8a650259b91088a362b09e041392896460946359bcf0b040ffed50c24de11a2 The OpenSSF Package Analysis project identified 'addcriteria' @ 69.69.69 npm as malicious. It is considered malicious because: - The package...

Missing key verification in gost

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...

CVE-2024-6470 playSMS Template injection

A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=featureinboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input id...

Malicious code in cra-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e49ccaa79a7296b7f1237beb3210cabf6610aab5c68e2c349b1fff4d3b2bb332 The OpenSSF Package Analysis project identified 'cra-docs' @ 7.999.45 npm as malicious. It is considered malicious because: - The package...

CVE-2024-39223

CVE-2024-39223 affects gost v2.11.5, where the SSH service can be compromised via an authentication bypass by configuring the HostKeyCallback to ssh.InsecureIgnoreHostKey. The Red Hat advisory reiterates the vulnerability description and references the same affected version, noting an authenticat...

The vulnerability of the PC Client component of the embedded applications and document management tools of Ricoh Streamline NX allows a perpetrator to execute arbitrary code.

The vulnerability of the PC Client component of the embedded applications and Ricoh Streamline NX document management tools is related to insufficient restrictions on communication channels for specified endpoints. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

[SECURITY] Fedora 40 Update: openssh-9.6p1-1.fc40.4

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

[SECURITY] Fedora 39 Update: openssh-9.3p1-11.fc39

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

CVE-2024-20898

Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information...

CVE-2024-20899

Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information...

CVE-2024-20896

Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information...

CVE-2024-20899

Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information...

CVE-2024-20899

Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information...

CVE-2024-20899

CVE-2024-20899 affects Samsung Mobile devices (IMS service, RCS function). The vulnerability stems from the use of implicit intents for sensitive communication in the RCS function, enabling local attackers to obtain sensitive information. Impact is described as local access with confidentiality e...