VulnCheck KEV: CVE-2019-2618

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: WLS Core Components. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

springframework: URL Parsing with Host Validation

A vulnerability was found in Spring Framework. Affected versions of this package are vulnerable to an Open Redirect when using UriComponentsBuilder to parse an externally provided URL and perform validation checks on the host of the parsed URL...

Defending Your Commits From Known CVEs With GitGuardian SCA And Git Hooks

All developers want to create secure and dependable software. They should feel proud to release their code with the full confidence they did not introduce any weaknesses or anti-patterns into their applications. Unfortunately, developers are not writing their own code for the most part these days...

MAL-2024-1375 Malicious code in @westpac-components-web/hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 935f3ecec4f48a905f04e98df7c4b7010c6fdc9900763c6aa3fe749e8ffd9237 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @westpac-components-web/hooks

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

VMware vbluetooth Code Execution

The vulnerability of the vbluetooth components in VMware Fusion and Vmware Workstation relates to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-4263 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-3848 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-3848 Source advisory: OSV:PYSEC-2024-244...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-4263 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-4263 Source advisory: OSV:PYSEC-2024-51...

CVE-2024-28042

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center...

CVE-2024-28042 SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center...

PT-2024-22232 · Unknown · Powersystem Center

Name of the Vulnerable Software and Affected Versions: PowerSYSTEM Center affected versions not specified Description: The issue concerns vulnerabilities in third-party components used in PowerSYSTEM Center. No specific details about the nature of the vulnerabilities, affected devices, or...

Vulnerability fixed in Microsoft Edge

Microsoft has fixed a vulnerability in Edge. A malicious party could exploit the vulnerability to gain access to system data. For successful abuse, the malicious party must trick the victim into opening a rogue link. This update also includes the vulnerabilities marked CVE-2024-4558, CVE-2024-455...

CVE-2024-28042: Reliance on Insufficiently Trustworthy Component

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center...

Improper Input Validation

Overview Microsoft.PowerBI.JavaScript is a suite of JavaScript web components for integrating Power BI into your app. Affected versions of this package are vulnerable to Improper Input Validation via the client-side data handling process. An attacker can expose sensitive information by intercepti...

RHEL 7 : openjdk (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - OpenJDK: URI parsing inconsistencies JNDI, 8278972 CVE-2022-21496 - OpenJDK: integer truncation issue in...

GHSA-2X52-8F29-7CJR Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component, an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component...

Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component, an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component...

CVE-2024-4536

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component https://github.com/eclipse-edc/Connector , an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security...

CVE-2024-4536

In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component https://github.com/eclipse-edc/Connector , an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security...