MAL-2022-3990 Malicious code in iv-gtin-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8eae136e05534a11c4f6f5028c64d8bd259e09ecc63c1be2fa60e0d659115543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3989 Malicious code in iv-build-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0da1f5b6ad11fed94f99710d6347cadc10f60bf1363f774afb7fd27c9226bf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3991 Malicious code in iv-node-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d22d43dc3fae73889f4b570379c506d709ce7f2d3602149f92e1c15176125cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iv-api-call-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b385feaf487d9c09c11277be1320cad3f84fedf26c5d42f9483a3935a049b98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iv-batcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cf3fea5becf2fb34093a5f1efc43553f6c1e3af0229edd3fde7835e1167bee6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iv-uv-latency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1596ca5100f1c7900ff79f52eaa66ef9b5cbb2990e3df94c1954f383892c2a9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3986 Malicious code in iv-api-call-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b385feaf487d9c09c11277be1320cad3f84fedf26c5d42f9483a3935a049b98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iv-api-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be3e0a7d1c6bc07419cb6e1cd98a32882c652fe538b9263b5352fb503fd60106 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3987 Malicious code in iv-api-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be3e0a7d1c6bc07419cb6e1cd98a32882c652fe538b9263b5352fb503fd60106 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-C2GG-RRHC-FVVG Magento 2 Community Edition Cryptographic Flaw

A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts...

mod_auth_openidc:2.3 security update

cjose 0.6.1-2 - fix concatkdf big endian architecture problem. Upstream issue 77. 0.6.1-1 - upgrade to latest upstream 0.6.1 0.5.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora29MassRebuild 0.5.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild 0.5.1-1 - Initial packagin...

Lemur uses static IV per key

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2022:1823)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1823 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an Open...

Moderate: mod_auth_openidc:2.3 security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: open redirect in oidcvalidateredirecturl CVE-2021-32786...

Information disclosure

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure...

UBUNTU-CVE-2022-23942

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure...

PYSEC-2022-43150

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure...

CVE-2022-23942

CVE-2022-23942 affects Apache Doris versions prior to 1.0.0, where the LDAP password cipher uses a hardcoded key and IV, enabling information disclosure. The issue is exploitable over the network with low attack complexity and no authentication required, compromising confidentiality (per CVSS met...

CVE-2022-23942 Apache Doris hardcoded cryptography initialization

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure...

Samsung Encryption Flaw

Researchers have found a major encryption flaw in 100 million Samsung Galaxy phones. From the abstract: In this work, we expose the cryptographic design and implementation of Androids Hardware-Backed Keystore in Samsungs Galaxy S8, S9, S10, S20, and S21 flagship devices. We reversed-engineered an...