Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example cgo can execute a gcc program from an untrusted download).

...

Malware in @rfv/modules

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-7051 Malicious code in @rfv/modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54928ac42ea161e8755f8a229b9b544f2da2b72cb2492e0f83b8ebe678a8f819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-5535 SSL_select_next_proto buffer overread

Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or ...

CVE-2024-5535

The OpenSSL library is vulnerable to a buffer overread in the SSL_select_next_proto function. The flaw occurs when the function is called with an empty supported client protocols buffer, potentially causing a crash or the exposure of up to 255 bytes of private memory to a peer. This issue primari...

OpenSSL 3.1.0 < 3.1.7 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.1.7. It is, therefore, affected by a vulnerability as referenced in the 3.1.7 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memor...

CVE-2024-5805

Improper Authentication vulnerability in Progress MOVEit Gateway SFTP modules allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0...

CVE-2024-5805

Improper Authentication vulnerability in Progress MOVEit Gateway SFTP modules allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0...

CVE-2024-5805 MOVEit Gateway Authentication Bypass Vulnerability

Improper Authentication vulnerability in Progress MOVEit Gateway SFTP modules allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0...

CVE-2024-5805

CVE-2024-5805 is an improper authentication vulnerability in Progress MOVEit Gateway (SFTP module) that allows authentication bypass affecting MOVEit Gateway 2024.0.0. A fix exists in MOVEit Gateway 2024.0.1; 2024.0.0 remains vulnerable. Vendor advisories and national/corporate feeds confirm patc...

CVE-2024-5805 MOVEit Gateway Authentication Bypass Vulnerability

Improper Authentication vulnerability in Progress MOVEit Gateway SFTP modules allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0...

CVE-2024-5805: Improper Authentication

Improper Authentication vulnerability in Progress MOVEit Gateway SFTP modules allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0...

PT-2024-41835

Уязвимость функций parsec secid и psc secid to lbl модулей ядра Linux Astra Modules связана с ошибками при блокировке потоков. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

PT-2024-41834

Уязвимость функции parsec sock opt del модулей ядра Linux Astra Modules связана с ошибками при блокировке потоков. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

EulerOS 2.0 SP11 : openssl (EulerOS-SA-2024-1842)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An...

CVE-2024-34992

SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" helpdesk up to version 2.4.0 from FME Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via 'Tickets::getsearchedtickets'...

CVE-2024-36683

SQL injection vulnerability in the module "Products Alert" productsalert before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via the ProductsAlertAjaxProcessModuleFrontController::initContent method...

CVE-2024-37021

Technical details for CVE-2024-37021 are not publicly available in the provided connected documents. The initial description references fpga_manager owner/refcount changes in the Linux kernel, but no further technical specifics (affected products/versions/fixes) are given here. Monitor for updates.

CVE-2024-34992: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" helpdesk up to version 2.4.0 from FME Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via 'Tickets::getsearchedtickets'...

CVE-2024-36683: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the module "Products Alert" productsalert before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via the ProductsAlertAjaxProcessModuleFrontController::initContent method...