Democritus Project 代码问题漏洞

Democritus Project is a collection of simple, effective, modular, fully tested and well-documented features from Democritus, Inc. A security vulnerability exists in Democritus Project d8s-domains, which arises from the distribution of a software package that contains a potential code execution...

CVE-2022-41384: Unrestricted Upload of File with Dangerous Type

The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

CVE-2022-41384

The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

CVE-2022-41384

Summary (CVE-2022-41384) The Python PyPI package d8s-domains (version 0.1.0) was found to include a potential code‑execution backdoor introduced by a third party (the democritus-urls package). This backdoor is the stated vulnerability mechanism and is the primary cause of the CVE. The connected d...

CVE-2022-41384

The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0...

PT-2022-25835 · Pypi · D8S-Domains +1

Name of the Vulnerable Software and Affected Versions: d8s-domains version 0.1.0 Description: The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. Recommendations: For versi...

GSD-2022-1006569 firmware: arm_scmi: Harden accesses to the reset domains

firmware: armscmi: Harden accesses to the reset domains This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.71 by commit...

PT-2022-34825 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.71 Description: The issue concerns the arm scmi firmware in the Linux Kernel, where accesses to the reset domains need to be hardened. The actual impact and attack plausibility have not yet been proven...

node-fetch: exposure of sensitive information to an unauthorized actor

A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as "Authorization," "WWW-Authenticate," and "Cookie" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized...

node-fetch: exposure of sensitive information to an unauthorized actor

A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as "Authorization," "WWW-Authenticate," and "Cookie" to potentially untrusted targets. This flaw leads to the exposure of sensitive information to an unauthorized...

Flagging 13 Million Malicious Domains in 1 Month with Newly Observed Domains

Threat Intelligence feeds are an integral part of any security strategy. In this new research see how Akamai researchers were able to find 8 million malicious domains every month to further protect our customers...

Flagging 13 Million Malicious Domains in 1 Month with Newly Observed Domains

Threat Intelligence feeds are an integral part of any security strategy. In this new research see how Akamai researchers were able to find 8 million malicious domains every month to further protect our customers...

Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that by injecting a cookie with certain special characters, an attacker on a shared subdomain, which is not a secure context, could set and overwrite cookies from a secure context, leading to session fixatio...

Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue that by injecting a cookie with certain special characters, an attacker on a shared subdomain, which is not a secure context, could set and overwrite cookies from a secure context, leading to session fixatio...

USN-5617-1: Xen vulnerabilities

It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. A local attacker could use th...

CVE-2022-40807

The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

CVE-2022-40427

The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0...

CVE-2022-40807

The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

Malicious Package

Overview democritus-domains is a malicious package. This package is used for dependency confusion attempts and contains malicious code. The package now exists as a placeholder on PyPI. Remediation Avoid using all malicious instances of the democritus-domains package. References - GitHub Issue -...

d8s-asns (0.1.0), d8s-domains (0.1.0) +8 more potentially affected by unknown CVE via democritus-json (2021.1.2501)

democritus-json PYPI version 2021.1.2501 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-json and may be impacted: - d8s-asns 0.1.0 - d8s-domains 0.1.0 - d8s-html 0.1.0 - d8s-ip-addresses 0.1.0 - d8s-mpeg 0.1.0 - d8s-networking 0.1.0 -...