MAL-2024-9058 Malicious code in cloudflare-docs-starlight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc416353baa88972c0106ceb1b2fa7077b9cfbcd687be15e44c70ee5edc0c526 The OpenSSF Package Analysis project identified 'cloudflare-docs-starlight' @ 1.1.1 npm as malicious. It is considered malicious because: - The...

Malicious code in cloudflare-docs-starlight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc416353baa88972c0106ceb1b2fa7077b9cfbcd687be15e44c70ee5edc0c526 The OpenSSF Package Analysis project identified 'cloudflare-docs-starlight' @ 1.1.1 npm as malicious. It is considered malicious because: - The...

Malicious code in world-id-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93838b8762b5668a88f866aca84e841a297e171d9f8f0e9258e2a9e99917d8ed The OpenSSF Package Analysis project identified 'world-id-docs' @ 10.10.10 npm as malicious. It is considered malicious because: - The package...

MAL-2024-9018 Malicious code in world-id-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93838b8762b5668a88f866aca84e841a297e171d9f8f0e9258e2a9e99917d8ed The OpenSSF Package Analysis project identified 'world-id-docs' @ 10.10.10 npm as malicious. It is considered malicious because: - The package...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Apache Tomcat [CVE-2024-34750]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Apache Tomcat, caused by a flaw when processing an HTTP/2 stream CVE-2024-34750. Apache Tomcat is used by our Speech microservices. This vulnerabilitiy has been addressed. Please read t...

Malicious code in storj-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c29c7e82f958f9ed89af6fc324d687bfe4e15d4b2aa49fee39f5aeeb4eee5583 The OpenSSF Package Analysis project identified 'storj-docs' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

[SECURITY] Fedora 41 Update: python3-docs-3.13.0~rc2-1.fc41

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

[SECURITY] Fedora 40 Update: python3.11-3.11.10-1.fc40

Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.11 package provides the "python3.11" executable:...

[SECURITY] Fedora 40 Update: python3.13-3.13.0~rc2-1.fc40

Python 3.13 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.13 package provides the "python3.13" executable:...

Fedora: Security Advisory (FEDORA-2024-486cb71423)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-b3d904cade)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-44085

ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression IIFE for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883...

CVE-2023-50883

ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...

CVE-2024-44085: Improper Neutralization of Input During Web Page Generation

ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression IIFE for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883...

CVE-2023-50883: Improper Neutralization of Input During Web Page Generation

ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...

CVE-2023-50883

ONLYOFFICE Docs prior to version 8.0.1 are affected. The issue stems from a macro implemented as an immediately-invoked function expression (IIFE) that enables sandbox escape by calling the Function constructor, leading to XSS. Impact per sources is XSS; affected component is the macro handling i...

CVE-2023-50883

ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...

PT-2024-13990 · Onlyoffice · Onlyoffice Docs

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs versions prior to 8.0.1 Description: The issue is related to an incorrect fix for a previous problem, which allows for Cross-Site Scripting XSS due to a macro being an immediately-invoked function expression IIFE. This enables...

CVE-2023-50883

ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...

PT-2024-30941 · Onlyoffice · Onlyoffice Docs

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs versions prior to 8.1.0 Description: The issue is related to a cross-site scripting XSS flaw in ONLYOFFICE Docs, which occurs through a GeneratorFunction Object attack on a macro. This is connected to the use of an...