Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

Cross site scripting

Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory it is possible to replace these DLLs and execute...

SUSE: Security Advisory (SUSE-SU-2024:0075-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Medium: jtidy

Issue Overview: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Affected Packages: jtidy Issue Correction: Run dnf update jtidy --releasever 2023.3.20240108 to updat...

Amazon Linux 2023 : jtidy, jtidy-javadoc (ALAS2023-2024-478)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-478 advisory. An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Tenable has extracted...

Service owners can accrue OLAS top-ups even when donating to their own services

Lines of code Vulnerability details Impact The basis of this exploit is the ability for a topUpEligible service owner — any registrant of a service who also stakes enough OLAS in the voting escrow contract — to accrue OLAS top-ups even when they donate to services that they own themselves. As lon...

Medium: jtidy

Issue Overview: An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-34623 Affected Packages: jtidy Issue Correction: Run dnf update jtidy --releasever 2023.3.20240108 or dnf...

Three Ways To Supercharge Your Software Supply Chain Security

Section four of the "Executive Order on Improving the Nation's Cybersecurity" introduced a lot of people in tech to the concept of a "Software Supply Chain" and securing it. If you make software and ever hope to sell it to one or more federal agencies, you have to pay attention to this. Even if y...

GitLab 12.6 < 14.1.7 (CVE-2021-22259)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API. CVE-2021-22259 Note that Nessus has not tested for this issue but ha...

Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC

Summary There are multiple vulnerabilities in Curl that affect PowerSC. PowerSC uses Curl as part of PowerSC Trusted Network Connect TNC. Vulnerability Details CVEID:CVE-2023-38039 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by not limiting the number and size of header...

Telegram-Nearby-Map - Discover The Location Of Nearby Telegram Users

Telegram Nearby Map uses OpenStreetMap and the official Telegram library to find the position of nearby users. Please note: Telegram's API was updated a while ago to make nearby user distances less precise, preventing exact location calculations. Therefore, Telegram Nearby Map displays users...

Moderate: Red Hat Security Advisory: RHACS 4.3 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes bug and security fixes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Design/Logic Flaw

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...

CVE-2023-49797 Local Privilege Escalation in pyinstaller on Windows

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...

SUSE-SU-2023:4693-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: Kubevirt is rebuilt against updated dependencies to fix security issues...

SUSE-SU-2023:4648-1 Security update for libreoffice

This update for fixes the following issues: libreoffice was updated rom 7.5.4.1 to 7.6.2.1 jscPED-6799, jscPED-6800: - For the highlights of changes of version 7.6 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.6 - You can check for each minor releas...

Test code in published microsoft-graph-beta package exposes phpinfo()

Impact The Microsoft Graph Beta PHP SDK published packages which contained test code that enabled the use of the phpInfo function from any application that could access and execute the file at vendor/microsoft/microsoft-graph-beta/tests/GetPhpInfo.php. The phpInfo function exposes system...

Malicious code in npm_package_devdependencies__types_jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5f8a28159fb1b2ef33b43e4aa71b0c85879d6220009091751cfa1590a1900329 The OpenSSF Package Analysis project identified 'npmpackagedevdependenciestypesjest' @ 30.5.0 npm as malicious. It is considered malicious...

SUSE-SU-2023:4582-1 Security update for slurm_22_05

This update for slurm2205 fixes the following issues: - CVE-2023-41914: Fixed a filesystem handling race condition that could have led to an attacker taking control of an arbitrary file, or removing entire directory contents bsc1216207. Bug fixes: - Add missing dependencies to slurm-config to...

SUSE-SU-2023:4581-1 Security update for slurm_22_05

This update for slurm2205 fixes the following issues: - CVE-2023-41914: Fixed a filesystem handling race condition that could have led to an attacker taking control of an arbitrary file, or removing entire directory contents bsc1216207. Bug fixes: - Add missing dependencies to slurm-config to...