Malware in @serenity-web/components-base

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @serenity-web/components-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c85633dc6373fe7b73c4d82c80a69e7b0997938dc620a25e7c74df66cf91257 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

org.infinispan:infinispan-cachestore-remote (12.0.0.cr1), org.infinispan:infinispan-cdi-remote (12.0.0.cr1) +12 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.0.0.cr1)

org.infinispan:infinispan-client-hotrod MAVEN version 12.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.infinispan:infinispan-cachestore-remote 12.0.0.cr1 -...

org.infinispan:infinispan-cachestore-remote (12.0.0.dev03), org.infinispan:infinispan-cdi-remote (12.0.0.dev03) +12 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.0.0.dev03)

org.infinispan:infinispan-client-hotrod MAVEN version 12.0.0.dev03 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.infinispan:infinispan-cachestore-remote 12.0.0.dev03 -...

org.infinispan:infinispan-cachestore-remote (12.1.13.final), org.infinispan:infinispan-cdi-remote (12.1.13.final) +13 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.1.13.final)

org.infinispan:infinispan-client-hotrod MAVEN version 12.1.13.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.infinispan:infinispan-cachestore-remote 12.1.13.final -...

org.infinispan:infinispan-cachestore-remote (12.1.0.cr2), org.infinispan:infinispan-cdi-remote (12.1.0.cr2) +12 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-client-hotrod (12.1.0.cr2)

org.infinispan:infinispan-client-hotrod MAVEN version 12.1.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-client-hotrod and may be impacted: - org.infinispan:infinispan-cachestore-remote 12.1.0.cr2 -...

CLSA-2023-1703611617 Fix CVE(s): CVE-2023-45539

SECURITY UPDATE: Accepting '' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact - debian/patches/CVE-2023-45539.patch: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header -...

CLSA-2023-1703183093 haproxy: Fix of CVE-2023-45539

CVE-2023-45539: do not accept '' as part of the URI component...

CLSA-2023-1703181305 haproxy: Fix of CVE-2023-45539

CVE-2023-45539: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header...

Sql injection

SQL Injection vulnerability in components/tablemanager/html/editadmintable.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6976 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6976 Source advisory: OSV:GHSA-WV8Q-4F85-2P8P...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6975 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6975 Source advisory: OSV:GHSA-HH8P-P8MP-GQHM...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6909 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6909 Source advisory: OSV:GHSA-5R3Q-93Q3-F978...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6974 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6974 Source advisory: OSV:GHSA-59V3-898R-QWHJ...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6977 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6977 Source advisory: OSV:GHSA-QG8P-32GR-GH6X...

CVE-2023-47990: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in components/tablemanager/html/editadmintable.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter...

CLSA-2023-1703008559 Fix CVE(s): CVE-2023-45539

SECURITY UPDATE: Accepting '' as part of the URI component might allow remote attackers to obtain sensitive information or have unspecified other impact - debian/patches/CVE-2023-45539.patch: h1: do not accept '' as part of the URI component; h2: reject more chars from the :path pseudo header -...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6940 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6940 Source advisory: OSV:GHSA-HVC6-42VF-JHF8...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6909 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6909 Source advisory: OSV:PYSEC-2023-252...

CVE-2023-48488 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting DOM-based XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...