CVE-2024-29886 Improved security for stored password hashes

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6...

OESA-2024-1250 containers-common security update

This package contains common configuration files and documentation for container tools ecosystem, such as Podman, Buildah and Skopeo. Security Fixes: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP wi...

aide (>=0.1.0, <=0.4.3), bpxe (>=0.1.0, <=0.1.2) +66 more potentially affected by unknown CVE via linkme (>=0.1.6, <=0.2.10)

linkme CARGO version =0.1.6, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2-alpha, =0.0.2-alpha, =0.0.4-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0407...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +187 more potentially affected by unknown CVE via gtk3-macros (>=0.14.0, <=0.18.2)

gtk3-macros CARGO version =0.14.0, =1.0.0, =0.2.0, =0.1.0, =0.2.0-alpha, =0.29.2, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.4.0, =0.7.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0419...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +309 more potentially affected by unknown CVE via gdk (>=0.3.0, <=0.18.2)

gdk CARGO version =0.3.0, =1.0.0, =0.2.0, =0.1.0, =0.1.2, =0.1.0, =0.21.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0412...

aipster (>=1.0.0, <=2.0.0), aki-image-view-gtk (>=0.2.0, <=0.2.10) +388 more potentially affected by unknown CVE via gtk-sys (>=0.3.4, <=0.18.2)

gtk-sys CARGO version =0.3.4, =1.0.0, =0.2.0, =0.1.0, =0.0.1, =0.1.2, =0.2.0-alpha, =0.21.0, =0.30.1 - avr-vm 0.1.0 - awl 0.0.1 - bare-metrics-gui 0.1.0 - battery-savior 0.1.0 - bbfpromix 0.1.0 - beemovie-gui 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0420...

CVE-2024-27092

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload external link is presented in clickable form - easier to achieve own goals by malicious actors. This iss...

Design/Logic Flaw

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload external link is presented in clickable form - easier to achieve own goals by malicious actors. This iss...

CVE-2024-27092

CVE-2024-27092 – Hoppscotch (API development ecosystem) involves a lack of validation for the field pair Label (Edit Team) – TeamName, enabling attackers to send emails with spoofed content presented as Hoppscotch. The issue is documented to affect Hoppscotch prior to the fix and is mitigated by ...

CVE-2024-27092 Content spoofing - real Hoppscotch emails

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload external link is presented in clickable form - easier to achieve own goals by malicious actors. This iss...

CVE-2024-27092 Content spoofing - real Hoppscotch emails

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload external link is presented in clickable form - easier to achieve own goals by malicious actors. This iss...

@adamlonsdale/backstage-plugin-armorcode-backend (>=0.0.1-alpha, <=0.0.4), @austin-garrard/backstage-plugin-backend (>=0.0.1-alpha.22, <=0.0.1) +194 more potentially affected by CVE-2024-26150 via @backstage/backend-common (>=0.0.0-nightly-20220708025041, <=0.17.0)

@backstage/backend-common NPM version =0.0.0-nightly-20220708025041, =0.0.1-alpha, =0.0.1-alpha.22, =0.0.1-alpha.18, =0.1.0, =0.0.0-nightly-20220709024234, =0.0.0-nightly-20220811024336, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20220709024234, =0.0.0-nightly-2021101322257,...

This Week in Spring - February 20th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you this fine 20th of February, 2024? I'm doing alright on this rainy 20th of Feburary here in San Francisco, and I hope you are too! We've got a ton of things to get into this week so let's dive right into it! Have y...

@icanbwell/composite (>=1.89.4, <=1.202.0), @icanbwell/native-components (>=0.21.6, <=0.31.0) +4 more potentially affected by CVE-2024-25466 via react-native-document-picker (>=9.0.1, <=9.1.0)

react-native-document-picker NPM version =9.0.1, =1.89.4, =0.21.6, =0.14.5, =1.1.0, =1.8.0 - @likeminds.community/feed-rn-core 0.6.0 - @likeminds.community/feed-rn-core-beta 0.0.1 Source cves: CVE-2024-25466 Source advisory: OSV:GHSA-PMGM-H3CC-M4HJ...

Celebrating Excellence: Alex Page Recognized As a CRN 2024 Channel Chief

Congratulations to Rapid7’s Vice President of Global Channel Sales, Alex Page, who is named among the newly-announced CRN 2024 Channel Chiefs! Alex, who also received this prestigious accolade in 2023, has been recognized for his outstanding contributions and expertise in driving strategic...

Mother of all Breaches may contain NEW breach data

On January 23, 2024, we reported on the discovery of billions of exposed records online, now commonly referred to as the “mother of all breaches” MOAB. Since then, the source of the dataset has been identified as data breach search engine Leak-Lookup. Prevention platform SpyCloud compared the MOA...

Post-quantum Cryptography for the Go Ecosystem

filippo.io/mlkem768 is a pure-Go implementation of ML-KEM-768 optimized for correctness and readability. ML-KEM formerly known as Kyber, renamed because we can't have nice things is a post-quantum key exchange mechanism in the process of being standardized by NIST and adopted by most of the...

chimper (>=0.3.0, <=0.4.0), conrod_example_shared (>=0.62.0, <=0.76.1) +26 more potentially affected by unknown CVE via conrod_core (>=0.62.0, <=0.76.1)

conrodcore CARGO version =0.62.0, =0.3.0, =0.62.0, =0.0.1, =0.67.0, =0.62.0, =0.71.0, =0.1.0, =0.1.0, =0.62.0, =0.69.0, =0.62.0, =0.2.1, =0.1.0, =0.24.0, =0.1.0-docfix, =0.25.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0396...

actix-session-surrealdb (>=0.1.0, <=0.1.5), bb8-surrealdb (>=0.1.0, <=0.1.3) +2 more potentially affected by CVE-2024-58368 via surrealdb (1.0.0-beta.9)

surrealdb CARGO version 1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-58368 Source advisory: OSV:GHSA-M24X-R6Q3-2VP9...

How Edge Computing Is Transforming Healthcare

There are myriad ways the healthcare and life sciences ecosystem benefits from edge computing. Read about the top five use cases for edge computing in healthcare...