8058 matches found
Malicious NPM Packages Target Roblox Users with Data-Stealing Malware
A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer malware such as Skuld and Blank-Grabber. "This incident highlights the alarming ease with which threat actors can launch supply chain attack...
CVE-2024-51987 HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect
Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by AddUserAccessTokenHttpClient may use a different user's access token after a token refresh occurs. This occurs because a refreshed token will be captur...
PT-2024-35077
Name of the Vulnerable Software and Affected Versions Duende.AccessTokenManagement.OpenIdConnect versions prior to 3.0.1 Description Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by...
CVE-2023-29122
Under certain conditions, access to service libraries is granted to account they should not have access to...
CVE-2023-29122 Incorrect file ownership of privileged service's libraries in Enel X JuiceBox
Under certain conditions, access to service libraries is granted to account they should not have access to...
CVE-2023-29122
The CVE-2023-29122 entry concerns Enel X Waybox (Waybox 3.0) with incorrect file ownership of the Privileged Services Library. The root cause enables a local attacker to gain root privileges by executing arbitrary OS commands. Affected component: Privileged Services Library; impact is root-level ...
CVE-2023-29122 Incorrect file ownership of privileged service's libraries in Enel X JuiceBox
Under certain conditions, access to service libraries is granted to account they should not have access to...
Moderate: Red Hat Security Advisory: python3.12 security update
An update for python3.12 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
PT-2024-12202
Name of the Vulnerable Software and Affected Versions Waybox affected versions not specified Description Under certain conditions, access to service libraries is granted to accounts that should not have access to them. This issue allows unauthorized access to service libraries. Recommendations At...
RHEL 7 : python-defusedxml and python-pysaml2 (RHSA-2017:0936)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:0936 advisory. The defusedxml package contains several Python-only updates for security vulnerabilities in Python's XML libraries. Defusedxml functions and classes...
Malicious code in sc-libraries (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e685150357e5118f6b99d29dcc954b4c5e33389fc7764e15ac72be42fbc1e27a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
[SECURITY] [DLA 3937-1] nss security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3937-1 [email protected] https://www.debian.org/lts/security/ Arturo Borrero Gonzalez October 27, 2024 https://wiki.debian.org/LTS -...
[SECURITY] Fedora 39 Update: glibc-2.38-19.fc39
The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important se...
[SECURITY] Fedora 39 Update: dotnet8.0-8.0.110-1.fc39
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...
[SECURITY] Fedora 40 Update: dotnet8.0-8.0.110-1.fc40
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...
[SECURITY] Fedora 41 Update: dotnet8.0-8.0.110-1.fc41
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...
OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
Summary In the database extension, the "enableloadextension" property can be set for the SQLite integration, enabling an attacker to load local or remote extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Details The...
GHSA-87CF-J763-VVH8 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
Summary In the database extension, the "enableloadextension" property can be set for the SQLite integration, enabling an attacker to load local or remote extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Details The...
