GHSA-2H3H-Q99F-3FHC @npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution @npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and t...

@npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution @npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and t...

GHSA-GMW6-94GG-2RC2 UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution @npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and t...

UNIX Symbolic Link (Symlink) Following in @npmcli/arborist

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution @npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and t...

aa2 (>=0.9.0, <=0.9.1), abridge (>=1.0.0, <=1.1.6) +429 more potentially affected by CVE-2018-20993 via yaml-rust (>=0.2.2, <=0.3.5)

yaml-rust CARGO version =0.2.2, =0.9.0, =1.0.0, =0.0.1, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.0.0, =0.1.0, =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.3.4 - asuran-cli 0.1.1 and more Source cves: CVE-2018-20993 Source advisory: OSV:GHSA-HV87-47H9-JCVQ...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Apr 2021

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 SR10-FP85 and Version 8 SR6-FP30 used by IBM Tivoli Application Dependency Discovery Manager TADDM. These issues were disclosed as part of the IBM Java SDK updates in Apr2021. Vulnerability Details CVEID:...

Security Bulletin: Apache CXF vulnerability identified in IBM Tivoli Application Dependency Discovery Manager (CVE-2021-30468)

Summary This security bulletin addresses the vulnerability in Open Source Apache CXF that affect IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2021-30468 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by an infinite loop flaw in the...

CVE-2021-39158

NVCaffe's python required dependencies list used to contain gfortranversion prior to 0.17.4, entry which does not exist in the repository pypi.org. An attacker could potentially have posted malicious files to pypi.org causing a user to install it within NVCaffe...

CVE-2021-39158

NVCaffe/Nvidia Caffe vulnerable in versions prior to 0.17.4 due to a faulty Python dependencies list that allowed a malicious PyPI file to be installed. The issue arises from a gfortran dependency entry that does not exist on PyPI, enabling potential data forgery if a malicious package is posted ...

CVE-2021-39158 Dependency injection in NVCaffe

NVCaffe's python required dependencies list used to contain gfortranversion prior to 0.17.4, entry which does not exist in the repository pypi.org. An attacker could potentially have posted malicious files to pypi.org causing a user to install it within NVCaffe...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020, Apr 2020

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 SR10-FP55 and Version 8 SR6-FP0 used by IBM Tivoli Application Dependency Discovery Manager TADDM. These issues were disclosed as part of the IBM Java SDK updates in Jan2020 and April2020. Vulnerability...

PT-2021-6524

Name of the Vulnerable Software and Affected Versions CKEditor versions 4.5.2 through 4.16.1 CKEditor 4 plugins with clipboard plugin dependency versions 4.5.2 and later, including: clipboard pastetext pastetools widget uploadwidget autolink tableselection Description The issue is related to...

Moderate: Red Hat Security Advisory: rust-toolset:rhel8 security, bug fix, and enhancement update

An update for the rust-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

systemd bug fix and enhancement update

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes...

Exploit for Code Injection in Exiftool_Project Exiftool

CVE-2021-22204 - Exiftool Remote Code Execution Descriptio...

Several Malicious Typosquatted Python Libraries Found On PyPI Repository

As many as eight Python packages that were downloaded more than 30,000 times have been removed from the PyPI portal for containing malicious code, once again highlighting how software package repositories are evolving into a popular target for supply chain attacks. "Lack of moderation and automat...

Fedora: Security Advisory for systemd (FEDORA-2021-166e461c8d)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

@random-guys/coralpay-pgp (>=0.0.1, <=0.1.0), @woocommerce/components (>=1.0.0, <=1.0.1) +4 more potentially affected by CVE-2020-13619 via locutus (>=2.0.10, <=2.0.11)

locutus NPM version =2.0.10, =0.0.1, =1.0.0, =1.1.0, =1.0.2, =1.0.52, =0.1.0, =0.2.1 Source cves: CVE-2020-13619 Source advisory: OSV:GHSA-H86X-MV66-GR5Q...

OESA-2021-1276 maven security update

Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: Apache Maven will follow repositories that are defined in a...

[SECURITY] Fedora 34 Update: systemd-248.5-1.fc34

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. It provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups,...