salt-vulnerabilities

Salt Stack Profile This profile will check to make sure your salt installation is patched to a level that protects you from CVE-2020-11651, and CVE-2020-11652. It does so by checking to ensure the packages salt-api, salt-cloud, salt-master, salt-minion, salt-ssh, salt-syndic, and salt are either...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the CachedClient.Get flow in pkg/xpkg/client.go. An attacker controlling an OCI registry can serve one signed image to fetcher.Head and validator.Validate, then swap the tag to differe...

safe-chain v1.5.13

Aikido Safe Chain ✅ Block malware on developer laptops and CI/CD ✅ Supports npm and PyPI more package managers coming ✅ Blocks packages newer than 48 hours without breaking your build ✅ Tokenless, free, no build data shared Need protection beyond npm & PyPI? Aikido Device Protection builds on Saf...

melange: Incomplete package integrity verification allows data section substitution

Previously, Apko verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files that get installed. An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file...

MiracleLinux 9 : Image builder components bug fix, enhancement and (AXSA:2024-8104:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8104:01 advisory. osbuild-composer: race condition may disable GPG verification for package repositories CVE-2024-2307 Tenable has extracted the preceding description block...

CVE-2019-20780

An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Certain security settings, related to whether packages are verified and accepted only from known sources, are mishandled. The LG ID is LVE-SMP-190002 April 2019...

EUVD-2018-21180

Malware in sbrugna...

EUVD-2019-11319

Malware in sbrugna...

EUVD-2022-39665

Malicious code in bioql PyPI...

CVE-2022-37008

The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect system stability...

CVE-2025-2763

CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this...

CVE-2023-52546

Vulnerability of package name verification being bypassed in the Calendar app. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2023-52538

Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability...

CVE-2023-52538

Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability...

CVE-2023-52537

A package name validation bypass vulnerability exists in the HwIms module within Huawei HarmonyOS and EMUI (a customized mobile operating system based on Android). The root cause is an improper handling of permissions or access control, specifically allowing the bypass of package name verificatio...

CVE-2023-52537

Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this vulnerability will affect availability...

PT-2023-23350 · Gl.Inet · Gl.Inet

Name of the Vulnerable Software and Affected Versions: GL.iNet devices versions prior to 3.216 Description: An issue was discovered that allows the installation of arbitrary software, such as a reverse shell, through the software installation feature. This is possible because the restrictions on...

SUSE CVE-2018-19639

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing e.g. with CVE-2018-19638 he can execute arbitrary commands as root...

CVE-2022-37008

The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect system stability...

CVE-2022-37008

CVE-2022-37008 affects Huawei/HarmonyOS recovery module. The issue allows bypassing verification of an update package before use, potentially impacting system stability. According to NVD, it has CVSS v3.1 base score 7.5 (High) with Network attack vector and No user interaction required; exploitat...