Malicious code in conversations-with-friends-by-sally-rooney-on-audible-new-volumes- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43a3c0ad8210a979fccfd7f614cae9493219922b5e13d2a02d9a84a2beda365d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in the-four-tendencies-the-indispensable-personality-profiles-that-reveal-how-to-make-your-life-better- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e9297cd32e9acc254a75e4a5d526916cc24499d026cbc04de40218284ff849 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth-test-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb18aabc5749a94ac657ae109997f03bd170e42c876bd450cc0bf43ee32619cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in poker_clock_professional_22_better_crack_h8z6f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d6822ba68ebf81c5841ac4bbc54ee01cb10d686b967ce796f11bd7fb993d79b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdc40_yamatake_manual_gi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9340e2ff538d820e82c4609b9b0033a3222f425183f5c83d6a525a01e93529b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Multiple path traversals on Windows hosts

Description validatepathissafe function in file /mlflow/server/handlers.py, introduced in PR 7891 on Feb 24th, 2023 does not account for Windows absolute path format, and thus can be bypassed on MLFlow servers, running on Windows hosts, exposing them to a number of high-impact directory traversal...

RTM Locker's First Linux Ransomware Strain Targeting NAS and ESXi Hosts

The threat actors behind RTM Locker have developed a ransomware strain that's capable of targeting Linux machines, marking the group's first foray into the open source operating system. "Its locker ransomware infects Linux, NAS, and ESXi hosts and appears to be inspired by Babuk ransomware's leak...

Malicious code in nodejs-cookie-proxy-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 950519ee04e89711e7732a030f308fa4bbb8f2dfa48713ba1070bbaaaa32070c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-2140

A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application...

Server side request forgery (ssrf)

A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application...

Malicious code in airbp-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85909d85812d972631236bae206926985a3338e536e82a3c983e278f08c4c6c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Dassault Systèmes DELMIA Apriso 代码问题漏洞

Dassault Systèmes DELMIA Apriso is an interactive manufacturing application for digital enterprises from Dassault Systèmes France. A security vulnerability exists in Dassault Systèmes DELMIA Apriso versions 2017 through 2022, which stems from the presence of a service area request forgery...

PT-2023-18175 · Dsi · Delmia Apriso

Name of the Vulnerable Software and Affected Versions: DELMIA Apriso versions 2017 through 2022 Description: A Server-Side Request Forgery issue could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application...

CVE-2023-29196 HTML injection via topic embedding in Discourse

Discourse is an open source platform for community discussion. This vulnerability is not exploitable on the default install of Discourse. A custom feature must be enabled for it to work at all, and the attacker’s payload must pass the CSP to be executed. However, if an attacker succeeds in...

PT-2023-22195 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest tests-passed, beta and stable branches Description: This issue affects Discourse, an open source platform for community discussion. It is not exploitable on the default install of Discourse, requiring a...

PT-2023-17413 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.1.0p27 Checkmk versions prior to 2.2.0b4 Description: The issue is related to insufficient permission checks in the REST API, allowing unauthorized users to schedule downtimes for any host. Recommendations: For...

Debian DSA-5382-1 : cairosvg - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5382 advisory. It was reported that cairosvg, a SVG converter based on Cairo, can send requests to external hosts when processing specially crafted SVG files with external file resource...

[SECURITY] [DSA 5382-1] cairosvg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5382-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 05, 2023 https://www.debian.org/security/faq -...

GLPI Manageentities Local File Inclusion

ADVISORY INFORMATION Exploit Title: GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin Date of found: 11 Jun 2022 Application: GLPI Manageentities 4.0.2 Author: Nuri Çilengir Vendor Homepage: https://glpi-project.org/ Software Link:...

[SECURITY] Fedora 38 Update: amanda-3.5.3-1.fc38

AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to one or more tape drives or disk files. AMANDA uses native dump and/or GNU tar facilities and can back up a...