CVE-2024-47869

Summary (CVE-2024-47869): Gradio (Python) contains a timing-attack vulnerability in the analytics_dashboard hash comparison that is not performed in constant time. An attacker could infer the correct hash byte-by-byte by measuring response times, potentially gaining unauthorized access to the ana...

CVE-2024-8508 affecting package unbound for versions less than 1.19.1-3

CVE-2024-8508 affecting package unbound for versions less than 1.19.1-3. A patched version of the package is available...

Huawei EulerOS: Security Advisory for gtk3 (EulerOS-SA-2024-2556)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2024-2580)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 39 : logiops (2024-69ce052378)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-69ce052378 advisory. Fixes CVE-2024-45752: A vulnerability that allows users to remap keys arbitrarily. This allows all users on the system to remap a key unexpectedly to a...

@belym.a.2105/publish-please (>=2.4.0-alpha.0, <=2.4.1), @digitalnative/standard-protocol-sdk (>=0.0.190, <=0.0.195) +48 more potentially affected by CVE-2024-21533 via ggit (>=2.0.0, <=2.4.12)

ggit NPM version =2.0.0, =2.4.0-alpha.0, =0.0.190, =1.1.2, =0.1.0, =4.1.6, =0.1.0, =0.1.0, =0.0.1, =1.7.3, =1.0.0, =0.13.4, =1.9.1, =1.0.0, =1.21.0, =1.23.3 and more Source cves: CVE-2024-21533 Source advisory: OSV:GHSA-PR45-CG4X-FF4M...

CVE-2024-21530

CVE-2024-21530 affects Cocoon before 0.4.0. The vulnerability arises when the encrypt, wrap, and dump functions are called sequentially with the same cocoon object, which can cause nonce reuse and allow an attacker to generate identical ciphertexts. The issue explicitly does not affect objects cr...

CVE-2024-21530

Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object. Note: The issue...

CVE-2024-21530

Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functions are sequentially called. An attacker can generate the same ciphertext by creating a new encrypted message with the same cocoon object. Note: The issue...

CVE-2024-2379 affecting package cmake for versions less than 3.30.3-2

CVE-2024-2379 affecting package cmake for versions less than 3.30.3-2. An upgraded version of the package is available that resolves this issue...

CVE-2024-21489

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype...

CVE-2024-21489

The CVE-2024-21489 entry concerns the uPlot library. Affected: uPlot versions before 1.6.31. Root cause: prototype pollution via uplot.assign due to missing check for Object.prototype, enabling modification of prototype attributes. Impact: could allow a remote attacker to execute arbitrary code o...

CVE-2024-21489

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype...

CVE-2024-21489

Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype...

MAL-2024-9048 Malicious code in ens.domains-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86e21617540f2c51cdccf6deb871c1f9e76cfaeb06a565c7265a1d7d5674e293 The OpenSSF Package Analysis project identified 'ens.domains-v2' @ 1.2.0 npm as malicious. It is considered malicious because: - The package...

Ubuntu: Security Advisory (USN-7030-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-3894 : booth - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3894 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3894-1 [email protected] https://www.debian.org/lts/security/...

Debian: Security Advisory (DLA-3891-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : python-setuptools (RHSA-2024:6662)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:6662 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

CVE-2024-21529

CVE-2024-21529 affects the dset npm package in versions before 3.1.4, where input sanitization allows prototype pollution via dset, injecting proto properties across objects. Impact is information leak or corruption through object prototype pollution; details describe the exact vulnerability vect...