SVG Formatter - Critical - Cross Site Scripting - SA-CONTRIB-2022-028

SVG Formatter module provides support for using SVG images on your website. Our dependency library enshrined/svg-sanitize has a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission that enables them to upload SVG images...

NPM Dependency confusion. Unclaimed NPM Package and Scope/Org

Lines of code Vulnerability details Impact I discovered an npm package and the scope of the package is unclaimed on the NPM website. This will give any User to claim that package and be able to Upload a Malicious Code under that unclaimed package. This results in achieving the Remote code executi...

Fedora: Security Advisory for libsolv (FEDORA-2022-f8921a3891)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: libsolv-0.7.21-1.fc35

A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks: - Using a dictionary approach to store and retrieve package and dependency information. - Using satisfiability, a well known and researched topic, for resolving package...

CVE-2022-24329

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects...

CVE-2022-24329

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects...

UBUNTU-CVE-2022-24329

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects...

CVE-2022-24329

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects...

CVE-2022-24329

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects...

PT-2022-16611 · Jetbrains · Jetbrains Kotlin

Name of the Vulnerable Software and Affected Versions: JetBrains Kotlin versions prior to 1.6.0 Description: The issue concerns the inability to lock dependencies for Multiplatform Gradle Projects in JetBrains Kotlin. This could potentially lead to unstable project configurations due to...

GHSA-8WR4-2WM6-W3PR B2 Command Line Tool TOCTOU application key disclosure

Impact Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race condition. The command line tool saves API keys and bucket...

CVE-2022-23653

B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a...

Update initializer modifier to prevent reentrancy during initialization

Lines of code Vulnerability details Impact While Governable.sol is out of scope, I figured this issue would still be fair game. The solution uses: "@openzeppelin/contracts": "4.2.0". This dependency has a known high severity vulnerability: Which makes this contract vulnerable: File: Governable.so...

编号撤回

libsolv is a library for checking package dependencies. libsolv has a security vulnerability, and no details of the vulnerability are currently provided...

编号撤回

libsolv is a library for checking package dependencies. libsolv is vulnerable to a heap overflow vulnerability, which stems from the existence of two memory vulnerabilities in libsolv located in the resolveweak function in src/solver.c. No detailed vulnerability details are currently available...

Arbitrary Code Execution

cayenne-server is vulnerable to arbitrary code execution. An attacker with client access to Cayenne ROP can transmit a malicious payload to any weak third-party dependency on the server...

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a...

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a...

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a...

Oracle Linux 8 : ruby:2.5 (ELSA-2022-0545)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0545 advisory. rubygem-bundler 1.16.1-4 - Fix Bundler dependency confusion. Resolves: CVE-2020-36327 Tenable has extracted the preceding description block directly from the...