OESA-2025-1027 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2025-1028 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

Exploit for Out-of-bounds Read in Microsoft

Usage and information Command - python3 CVE-2024-49...

Host Active Directory Configuration (Linux)

Binary data hostadconfiglinux.nbin...

PT-2025-54828

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.14 Apache Tomcat versions 10.1.0-M1 through 10.1.49 Apache Tomcat versions 9.0.0-M1 through 9.0.112 Apache Tomcat versions 8.5.0 through 8.5.100 Description Tomcat did not properly validate the hos...

PT-2026-1659

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description The libssh software contains a flaw related to a global knownhost override. This issue could potentially allow an attacker to bypass host key verification, potentially leading to...

Authentication Token Leakage

github.com/cli/go-gh is vulnerable to authentication token leakage. The vulnerability is due to improper handling of authentication tokens, where auth.TokenForHost could source a token from the GITHUBTOKEN environment variable for non-GitHub hosts within a codespace...

Malicious code in goji-js-org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1158451b8e262941308f40c4e30935ba7abac4515ecb1d090b6fd1be2e507198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in manajemenservice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00f781e5ec61ec2d725507626667d8de0819e01e64f92bcd3d1b5232b99df76d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uflexreward-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57620816e143ff2658a9323cbf5e516cacf63db55bbe14fecdabeafd68bf1d8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in quintoandar-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4af1eeb8b81ed935d92039b3a23f267d60ba38766214fd0254d9530a3c9b08e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in client-consent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ebc6cac6d302018d141c45adee10302556bd3da3491d12734412f967aea772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uchiwa-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93c81ac91a1060b8f7257839e951572af3ef296d5fecede6f6e9bf69bca76d25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in imran-spotifydl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3800cf40bde01dd8a476c0c1967b5e7bceaf578a40d99d3561a626ba1ef5d24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

python: Improper validation of IPv6 and IPvFuture addresses

A flaw was found in Python. The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture compliant. This behavior was not conformant to RFC 3986 and was potentially vulnerable to server-side request forgery SSRF if a URL is...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : PHP vulnerabilities (USN-7157-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7157-1 advisory. It was discovered that PHP incorrectly handled certain inputs when processed with convert.quoted-printable decode filters...

curl 安全漏洞

curl is a cURL open source tool for transferring data from or to a server. A security vulnerability exists in curl that stems from the fact that it can, under certain circumstances, disclose the password used by the first host to subsequent hosts...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : avahi (SUSE-SU-2024:4196-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4196-1 advisory. - CVE-2024-52616: Fixed Avahi Wide-Area DNS Predictable Transaction IDs bsc1233420 Tenable has extracted...

BIT-PYTHON-2024-11168 Improper validation of IPv6 and IPvFuture addresses

The urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser...

Malicious code in auto-plugin-appetize-cleanup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b5ae41ae089a0123963d0d11e9e9c097d2ea1c9a9610c8b8d626303631ed5e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...