CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

Information Disclosure

libgrpc.so is vulnerable to Information Disclosure. The vulnerability is due to an error status for a misencoded header not cleared between header reads, resulting in subsequent incrementally indexed added headers in the first request being poisoned until cleared from the HPACK table. This can be...

MAL-2024-7973 Malicious code in mapbox-maps-android (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6283105b5c07939844bd2730cc42bf4c6e8d9bbaf713a147707078aa4e14a4d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7955 Malicious code in fabricexample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4137c5f31f16d594edda141045f7330412108a4d9bc3bb7f4786e8d6e4c09eb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7941 Malicious code in bs58node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0bc63ca148e297326d229ab17cad2fe91c923308400c4027721533605fb2440 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7939 Malicious code in bignit.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43b97d2fd30b80db3253e6999e0e6bbc4ba13e245a6eeb28a167f1eeeefec161 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7940 Malicious code in bs58lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66b5203201dce86ff759e5c55007837099f74ef7bd7d925ebf3c4420106f5889 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7995 Malicious code in theme-bahrain-nb-hdddc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22b870164e088eff8d02fbc7631e1a1635a1810965e38de6362e8d93dc02434d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7994 Malicious code in theme-bahrain-nb-hddd2c (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2c4d9f69a68847d94866c5c7615ea8e879f744fe989442fd0e658480480744e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-29718 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.10.0 through 4.19.1.0 Description: The issue is caused by an access permission validation problem that allows domain admin accounts to query all registered account-users API and secret keys, including those of the...

CVE-2024-7246

A flaw was found in Google gRPC due to HPACK table poisoning between the proxy and backend so that other clients see failed requests, resulting in a denial of service. This occurs because the error status for a misencoded header is not cleared between header reads, resulting in subsequent...

DEBIAN-CVE-2024-7246

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the...

SUSE CVE-2024-42155

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or...

SUSE CVE-2024-42156

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key...

MAL-2024-7905 Malicious code in @bingads-webui-react/with-site-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 997e1cce193e872c031f1482119f4899f32d99a1ecc7dc194270a504607c421e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Django SQL注入漏洞

Django is a set of open source web application framework based on Python language from Django Foundation. The framework includes an object-oriented mapper, view system, template system, and more. An SQL injection vulnerability exists in Django versions prior to 5.0 to 5.0.8 and 4.2 to 4.2.15, whi...

MAL-2024-7887 Malicious code in dea-hallow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60d117e12ade65c2393741c7e014711e7b75200cb4ff881eb855997fc6023bb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7889 Malicious code in permenmd-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db6efdc7a6ea747eacdf9b6dbd68c824e07aa445ac5c745fe847bf13866414c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7891 Malicious code in permenmd-wifi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2574afbf5c3faac083fdab7db2254f6589a6bd17e6b42868bd5478a6a1397981 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7892 Malicious code in prmnmd-tuls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 422a0a19eabc0aeb101d13844348daed919589aa7aa3b6567c3146a5850c7678 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...