MAL-2024-1373 Malicious code in @ozon-ob-foundation/tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4870f4e08a8884dceac0f1a3032fde78810c30390ddff720817ebfad9108ec65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1371 Malicious code in @ozon-ob-foundation/communication (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbd79919619acaea0f1d0de932d737a71b7ac5c27049e11483522540d39daed7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1370 Malicious code in @ozon-fe/media-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f83f6ec5a227a2759eaf3a0f63b52ed88c790c3af44ea8bf3a9fa132d746220e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1369 Malicious code in mixtral-llm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8f29dbee4aa92684c9adc9e0484e255cac83931500c1651073b71123d728fd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1368 Malicious code in brand-adidas-design-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e16fae72fd3726263d7bfa2f1c164b7d4100f89931856c163e37c534feb1a57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1367 Malicious code in brand-adidas-asset-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35b2e8dbb891acdef0e8c7d2e97c0b27c3e6e9d4fb4ff284fa0d9542acb2c893 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Excessive time spent checking DSA keys and parameters

...

FreeBSD : OpenSSL -- Denial of Service vulnerability (b88aa380-1442-11ef-a490-84a93843eb75)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b88aa380-1442-11ef-a490-84a93843eb75 advisory. - Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary:...

nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values

Versions of nzo/url-encryptor-bundle prior to 5.0.1 and 4.3.2 are affected by a security vulnerability related to the lack of mandatory key and IV requirements. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure...

namshi/jose - Verification bypass

Several widely-used JSON Web Token JWT libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys RS256, RS384, RS512, ES256, ES384, ES512...

GHSA-4RR6-GF59-GGW5 namshi/jose - Verification bypass

Several widely-used JSON Web Token JWT libraries, including node-jsonwebtoken, pyjwt, namshi/jose, php-jwt, and jsjwt, are affected by critical vulnerabilities that could allow attackers to bypass the verification step when using asymmetric keys RS256, RS384, RS512, ES256, ES384, ES512...

CVE-2023-52424

CVE-2023-52424 describes an SSID confusion vulnerability in IEEE 802.11 where the SSID is not always used to derive PMK/session keys and the 4‑way handshake may proceed without a protected SSID exchange. An adjacent attacker can lure victims to connect to an unintended/untrusted network using Hom...

OESA-2024-1605 python-jinja2 security update

Jinja2 is one of the most used template engines for Python. It is inspired by Django's templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications...

Authentication Bypass

firebase/php-jwt is vulnerable to Authentication Bypass. The vulnerability is due to missing algorithm checks when calling the decode method allowing attackers bypass verification when using asymmetric keys RS256, RS384, RS512, ES256, ES384, ES512 when there is no algorithm specified within the...

SUSE CVE-2024-4603

Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVPPKEYparamcheck or EVPPKEYpubliccheck to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked...

EulerOS Virtualization 3.0.6.6 : openssl098e (EulerOS-SA-2024-1661)

According to the versions of the openssl098e package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2024-1706)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of Juniper Networks Junos OS, an open-source infrastructure demon, allows a attacker to cause a service failure.

The vulnerability of open-source Juniper Networks Junos OS infrastructure related to open-source keys pkid is associated with insufficient checks for exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

EulerOS Virtualization 3.0.6.6 : shim (EulerOS-SA-2024-1666)

According to the versions of the shim package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions...

EulerOS Virtualization 3.0.6.6 : openssl (EulerOS-SA-2024-1660)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the...