[SECURITY] Fedora 35 Update: asciigraph-0.5.5-2.fc35

Go package to make lightweight ASCII line graph =EF=BF=BD=EF=BF=BD=EF=BF=BD =EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD in command line apps w ith no other dependencies...

fastify-bearer-auth vulnerable to Timing Attack Vector

Impact fastify-bearer-auth does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack...

[SECURITY] Fedora 36 Update: micro-2.0.8-5.fc36

Micro is a terminal-based text editor that aims to be easy to use and intuitive, while also taking advantage of the full capabilities of modern terminals. It comes as one single, batteries-included, static binary with no dependencies, and you can download and use it right now. As the name...

[SECURITY] Fedora 36 Update: golang-github-appc-docker2aci-0.17.2-9.fc36

Docker2aci is a small library and CLI binary that converts Docker images to A CI. It takes as input either a file generated by "docker save" or a Docker regist ry URL. It gets all the layers of a Docker image and squashes them into an ACI image. Optionally, it can generate one ACI for each layer,...

RUSTSEC-2022-0056 clipboard is Unmaintained

Last release was almost 4 years ago and the repository with outstanding issues and pull requests seems to be abandoned by the maintainer. In addition the sole maintainer account may be abandoned that may represent account takeover risk. Current outstanding issues include vulnerable dependencies...

clipboard is Unmaintained

Last release was almost 4 years ago and the repository with outstanding issues and pull requests seems to be abandoned by the maintainer. In addition the sole maintainer account may be abandoned that may represent account takeover risk. Current outstanding issues include vulnerable dependencies...

OPENSUSE-SU-2022:10014-1 Security update for tensorflow2

This update for tensorflow fixes the following issues: Update to TF2 2.6.0 which fixes multiple CVEs boo1189423. - Introduction of bazel6.3 and basel-skylib1.0.3 as build dependencies. The latter has been adapted to all a version in its package name if %setversuffix is set to 1. This allows...

Security update for tensorflow2 (moderate)

openSUSE Security Update: Security update for tensorflow2 Announcement ID: openSUSE-SU-2022:10014-1 Rating: moderate References: 1173128 1173314 1178287 1178564 1179455 1181864 1186860 1189423 Cross-References: CVE-2020-26266 CVE-2020-26267 CVE-2020-26268 CVE-2020-26270 CVE-2020-26271...

GHSA-RPHM-C8GW-3R38 OS Command Injection in lifion-verify-deps

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

OS Command Injection in lifion-verify-deps

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

CVE-2021-34078

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

CVE-2021-34078

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

lifion-verify-dependencies 操作系统命令注入漏洞

lifion-verify-dependencies is lifion's way of checking that the installed NPM module is the latest version currently available. A security vulnerability exists in lifion-verify-dependencies version 1.1.0, which can be exploited by an attacker to execute remote code...

CVE-2021-34078

CVE-2021-34078 affects lifion-verify-dependencies up to version 1.1.0, enabling an OS command injection via a crafted dependency name in a project’s package.json. Multiple connected sources (Red Hat, Veracode, GitHub advisories, CVE/CVE lists) corroborate the vulnerability and its impact (high se...

Local Command Injection Post-Installation of Dependencies

Description grav version x";touch pwned "/user/plugins/problems sh: 1: cd: can't cd to x SUCCESS cloned https://github.com/getgrav/grav-plugin-error - x";touch pwned "/user/plugins/error sh: 1: cd: can't cd to x SUCCESS cloned https://github.com/getgrav/grav-plugin-markdown-notices - x";touch pwn...

SUSE-SU-2022:1853-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: - CVE-2022-23303, CVE-2022-23304: Fixed SAE/EAP-pwd side-channel attacks bsc1194732, bsc1194733 - CVE-2021-0326: Fixed P2P group information processing vulnerability bsc1181777 - Fix systemd device ready dependencies in...

GHSA-59GP-QQM7-CW4J Nokogiri has vulnerable dependencies on libxml2 and libxslt

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

GHSA-PMXF-4V8C-RWR7 Incorrect Resource Transfer Between Spheres in Grails

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

GHSA-27J5-2H6R-C9Q2 OpenAPI Tools OpenAPI Generator uses HTTP in various files

OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecurely resolved dependencies...

GHSA-PPRQ-4488-WGQX Insecure transport protocol in Gradle

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site...