PT-2024-7453 · Unknown · Matrix-React-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-react-sdk versions 3.18.0 through 3.101.9 Description: The issue is related to insufficient protection of service data, allowing a malicious homeserver to potentially steal message keys for a room when a user invites another user to th...

PT-2024-21701 · Toshiba Tec · Toshiba Tec E-Studio Multi-Function Peripheral

Name of the Vulnerable Software and Affected Versions: Product Name affected versions not specified Description: The issue involves hardcoded keys used for authentication to an internal API. If an attacker obtains these private keys, they may bypass authentication and access administrative...

Cilium leaks sensitive information in cilium-bugtool

Impact The output of cilium-bugtool can contain sensitive data when the tool is run with the --envoy-dump flag set against Cilium deployments with the Envoy proxy enabled. Users of the following features are affected: - TLS inspection - Ingress with TLS termination - Gateway API with TLS...

Privilege Escalation

Azure Identity and Microsoft Authentication are vulnerable to Privilege Escalation. The vulnerability is due to improper handling of tokens and keys within DefaultAzureCredential and ManagedIdentityCredential classes, allowing an attacker to elevate to SYSTEM privileges read arbitrary files on th...

MAL-2024-1606 Malicious code in djangosnippets.org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c166a453b773becdea05dfd92ed988141528a96f6dc77e8435f871c68c0d3f1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1608 Malicious code in legacyreact-aws-s3-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60942b87c6d2334d09d059276cc2d838002e2e0f5093e53fc6819e1972e02282 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1605 Malicious code in dependences (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01937c3da9bea8e85a1f2b11953989f03d30855db63d1feaca17c660227a83c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1599 Malicious code in ozonid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 434f32feef52077406cbebac21bd52caaa41481baf68aeebb0daf1edf7783269 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1597 Malicious code in exel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6083dc24b3cdb6bfd02f5426aa373f2425aab6e9508e12255fc1e08133809bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Improper Access Control

scikit-learn is vulnerable to Improper Access Control. The vulnerability is due to the unexpected storage of all tokens in the stopwords attribute, which can leak sensitive information such as passwords or keys when using the TfidfVectorizer class...

MAL-2024-1593 Malicious code in ato-z-web-identity-components-app-cdk-adp-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c33c62d31d74de8fa6a7a3911507ce9a8d513bccb45ff1b51b7fbb9068920d3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1594 Malicious code in atoz-attendance-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff390162beebf06ba564766a3ffc0a06c520792994c16cba3ea0d97ea64d1f29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-5206

A vulnerability was found in the scikit-learn package. Before version 1.4.1, post1 scikit-learn stores all tokens with "stopwords" attributes. This action may cause scikit-learn to expose sensitive data that will not be used in the model training, possibly leaking passwords and keys...

Unbreakable Enterprise kernel security update

5.15.0-207.156.6 - uek-container: Add advanced routing options Boris Ostrovsky Orabug: 36691279 - slub: use countpartialfreeapprox in slaboutofmemory Jianfeng Wang Orabug: 36655468 - slub: introduce countpartialfreeapprox Jianfeng Wang Orabug: 36655468 - Revert 'lockd: introduce safe async lock o...

CVE-2024-5813

A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an information leak in the server response...

CVE-2024-5813

A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an information leak in the server response...

CVE-2024-5813 SSH Private Key Leak in BeyondInsight PasswordSafe

A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an information leak in the server response...

CVE-2024-5813

CVE-2024-5813 affects BeyondInsight Password Safe (BIPS). An authenticated attacker with high privileges can exploit an information leak in the server response to access SSH private keys, exposing highly sensitive material. The vulnerability targets the confidentiality of SSH keys via a disclosur...

MAL-2024-1582 Malicious code in noblox.js-proxy-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49cb85854d6a908a38177c4a3c30ac7dd724e1f892e3fbfcb26bb3a146ad2dc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1573 Malicious code in bootstrap-npm-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fd1dc66e2c97cb20814b56fc5ff776a96f0851f09647f1cef4cfb305ec2b3a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...