CVE-2019-15608

The package integrity validation in yarn 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack...

The vulnerability of the software dpkg, used for installing, removing, and retrieving information about deb-packages in the Astra Linux operating system, relates to a security feature that allows an attacker to compromise the integrity of the installed package.

The vulnerability in the dpkg software, which is used for installing, removing, and retrieving information about deb-packages in the Astra Linux operating system, relates to the verification of package integrity during installation. Exploiting this vulnerability allows a malicious actor to...

Hardcoded credentials

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

USN-3156-1 apt vulnerability

Jann Horn discovered that APT incorrectly handled InRelease files. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages...

Debian DSA-3217-1 : dpkg - security update

Jann Horn discovered that the source package integrity verification in dpkg-source can be bypassed via a specially crafted Debian source control file .dsc. Note that this flaw only affects extraction of local Debian source packages via dpkg-source but not the installation of packages from the...

Debian: Security Advisory (DSA-3217-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PYSEC-2013-10

pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation...

MDKSA-2000:028 kon2 update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Linux-Mandrake Security Update Advisory Package name: kon2 Date: August 1st, 2000 Advisory ID: MDKSA-2000:028 Affected versions: 7.0, 7.1 Problem Description: There is a vulnerable suid program called fld. This program accepts option input from a text...

ROS-2-1492

2.1492 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...