alectio-sdk (>=0.6.2, <=0.6.14), alectiolite (0.0.1) +4 more potentially affected by CVE-2024-40647 via sentry-sdk (0.15.1)

sentry-sdk PYPI version 0.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - alectio-sdk =0.6.2, =0.4.3, =0.5.0a5 Source cves: CVE-2024-40647 Source advisory: OSV:GHSA-G92J-QHMH-64V2...

This Week in Spring - July 9th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it's been! We've got a lot to get into, so let's dive right in. I quite liked this talk, Continuations: The magic behind virtual threads in Java by Balkrishna Rawool @ Spring I/O 2024 In last week's episode of...

com.amazon.jenkins.fleet:ec2-fleet (>=1.0, <=1.17.3), com.cloudbees.jenkins.plugins:amazon-ecr (1.6) +15 more potentially affected by CVE-2024-39459 via org.jenkins-ci.plugins:plain-credentials (1.0)

org.jenkins-ci.plugins:plain-credentials MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:plain-credentials and may be impacted: - com.amazon.jenkins.fleet:ec2-fleet =1.0, =1.4, =1.0.0-b13, =1.0-alpha-3, =0.3,...

MAL-2024-4068 Malicious code in Be.Vlaanderen.Basisregistеrs.Sqs.Lаmbda (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaanderen.Basisregistеrs.Sqs.Lаmbda (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4078 Malicious code in Be.Vlaanderen.Basisrеgisters.Aws.Lаmbda (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaanderen.Basisrеgisters.Aws.Lаmbda (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4086 Malicious code in Be.Vlaanderen.Basisrеgistеrs.Sqs.Lаmbdа (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaanderen.Basisrеgistеrs.Sqs.Lаmbdа (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4228 Malicious code in Be.Vlaaոderen.Basisrеgistеrs.Aws.Lаmbda (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոderen.Basisrеgistеrs.Aws.Lаmbda (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2422 Malicious code in github-runner-lambda-syncer (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in github-runner-lambda-syncer (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-37293

The CVE concerns the AWS Deployment Framework (ADF) bootstrap process. Prior to v4.0.0, the bootstrap CodeBuild role could call sts:AssumeRole without restrictions, enabling escalation to any AWS account in the organization with elevated privileges. Patches are included in aws-deployment-framewor...

CVE-2024-37293

The AWS Deployment Framework ADF is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations...

CVE-2024-37293 aws-deployment-framework's potential risk can lead to privilege escalation

The AWS Deployment Framework ADF is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations...

Malware in lambda-iss-location

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in lambda-iss-location (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d7bd1b87c4b816789f583c6667d202f613eab5d352c1fcbe90fe1b182a0d13c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Keras 2 Lambda Layers Allow Arbitrary Code Injection in TensorFlow Models

Overview Lambda Layers in third party TensorFlow-based Keras models allow attackers to inject arbitrary code into versions built prior to Keras 2.13 that may then unsafely run with the same permissions as the running application. For example, an attacker could use this feature to trojanize a...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.0.cr2), io.quarkus:io.quarkus.gradle.plugin (1.3.0.cr2) +245 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.3.0.cr2)

io.quarkus:quarkus-core MAVEN version 1.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.0.cr2 - io.quarkus:io.quarkus.gradle.plugin 1.3.0.cr2 -...