Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system

Impact This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with GHSA-p8r3-83r8-jwj5 to overwrite files on the host system. In order to use this...

Malicious code in @superbet-group/web.lib.utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fab50162238435411f24dc3fc8561c82b1104a4caec2bc9878378e56f77ab46e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-64 Malicious code in @superbet-group/web.lib.utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fab50162238435411f24dc3fc8561c82b1104a4caec2bc9878378e56f77ab46e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-25168 Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with GHSA-p8r3-83r8-jwj5 to overwrite files on the host system. In order to use this exploit, an attacker must have an...

CVE-2023-25168

CVE-2023-25168 affects Pterodactyl Wings (server control plane). Description: UNIX Symbolic Link (Symlink) Following enables deletion of files/directories on the host when a server is allocated; may be used with GHSA-p8r3-83r8-jwj5 to overwrite host files. Root cause: symbolic link handling in Wi...

GHSA-R7JW-WP68-3XCH vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-W67W-MW4J-8QRV vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-29XX-HCV2-C4CP vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-V5W6-WCM8-JM4Q vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-VXRH-CPG7-8VJR vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-VRH7-X64V-7VXQ vulnerabilities

Vulnerabilities for packages: openssl-provider-fips, openssl...

GHSA-X4QR-2FVF-3MR5 vulnerabilities

Vulnerabilities for packages: openssl, mitmproxy...

GHSA-74FP-R6JW-H4MP vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache...

GHSA-P4G4-WGRH-QRG2 vulnerabilities

Vulnerabilities for packages: dgraph...

MAL-2023-25 Malicious code in @bingads-webui-campaign/accounts-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ea51a5005ea339d4227b814c1db738fc053acf8b3802ddc0afddbaa1c8cbfb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-24808 Denial Of Service when opening a corrupt PDF file in pdfio

PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service DOS vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28...

CVE-2023-24808

CVE-2023-24808 affects the PDFio C library (reading/writing PDFs) with a denial-of-service flaw in the pdfio parser for versions before 1.1.0. Crafted PDFs can drive the parser to 100% CPU utilization and never terminate, potentially impacting servers or processes that convert uploaded PDFs to pl...

CVE-2023-24808 Denial Of Service when opening a corrupt PDF file in pdfio

PDFio is a C library for reading and writing PDF files. In versions prior to 1.1.0 a denial of service DOS vulnerability exists in the pdfio parser. Crafted pdf files can cause the program to run at 100% utilization and never terminate. The pdf which causes this crash found in testing is about 28...

GHSA-8MJG-8C8G-6H85 vulnerabilities

Vulnerabilities for packages: spark-operator...

MAL-2023-31 Malicious code in @buffer-mono/png-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9244d2dab3f1dfded05311dc18e1475aa475a5526b78409227c8b03dae2d3091 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...