ALSA-2024:9333 Low: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: Unbounded memory growth with session handling in TLSv1.3 CVE-2024-2511 openssl: Excessive time...

Checking excessively long DSA keys or parameters may be very slow

OpenSSL contains an unbounded computation flaw when performing checks on excessively large DSA keys or parameters, which could lead to a denial-of-service DoS attack. The OpenSSL pkey, pkeyparam command line apps, and FIPS providers are affected...

VulnCheck KEV: CVE-2024-9465

Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the...

Low: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: Unbounded memory growth with session handling in TLSv1.3 CVE-2024-2511 openssl: Excessive time...

OpenSSL is vulnerable to a denial of service, caused by a flaw in the handling of RSA public keys by the EVP_PKEY_public_check() function

OpenSSL is vulnerable to a denial-of-service DoS issue due to how there is no restriction on RSA public key size, or the subsequent time spent processing such keys. Applications that use the EVPPKEYpubliccheck function to check RSA public keys obtained from potentially untrusted sources can be...

GHSA-VPQ5-56JJ-VF2M Moodle admin presets export tool includes some secrets that should not be exported

A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party...

Moodle admin presets export tool includes some secrets that should not be exported

A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party...

Information Exposure

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Information Exposure due to the inclusion of sensitive secrets and keys in the exported site administration presets. Remediation Upgrade moodle/moodle to version 4.4.2, 4.3.6, 4.2.9, 4.1.12 or highe...

CVE-2024-43427 Moodle: admin presets export tool includes some secrets that should not be exported

A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party...

CVE-2024-43427 Moodle: admin presets export tool includes some secrets that should not be exported

A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party...

Path traversal, lead to arbitrary file write, lead to remote code execution

Description Anythingllm use multer library to handle http multi-part file upload. Anything llm use the following code to handle non-ascii file name file.originalname = Buffer.fromfile.originalname, "latin1".toString "utf8" ; This way of manipulating filename is will lead to path traversal. multer...

Input: adp5589-keys - fix NULL pointer dereference

...

Leakage of Langfuse API keys in team exception handling

This report is not public...

MAL-2024-10538 Malicious code in solara (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e438962687b438b87b87f8223d415da1ee3726954b8fd23aa3bb8a866f1eec0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10505 Malicious code in eth-rpceerrors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89924b0dbf399fafdb354a5dc79f9e69087983ff7fb05942d3aefdd518ea06c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10510 Malicious code in ethmetadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 606140ec337ea20ea1b64f53dbe37d4674690233e1acdbd01a6b481532b6e9b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10500 Malicious code in eth-cmeta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e390d3f621f6795cefcac7ff48cd9734854f2734360b55599683db6ece8b468d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10507 Malicious code in ethens-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2587aaeff09cedb01639d066a033a97d01f1137b14788e741c56f5801b6f38b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin CE21 Suite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

MAL-2024-10493 Malicious code in 1234wdzwkcsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24a9740048ac983c055f06c0c70ef23cd9654f1afc41a6b809febf6ea84f4aa2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...