CVE-2024-21491

SVIX before version 1.17.0 is affected by an authentication bypass vulnerability in the Webhook verification logic. The root cause is an incorrect comparison of signatures of different lengths in the verify function, allowing an attacker to bypass signature verification by supplying a shorter sig...

CVE-2024-25718

In the Samly package before 1.4.0 for Elixir, Samly.State.Store.getassertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry...

Input validation

This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of servic...

CVE-2024-21490

This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in...

CVE-2024-23653 affecting package moby-compose for versions less than 2.17.2-7

CVE-2024-23653 affecting package moby-compose for versions less than 2.17.2-7. A patched version of the package is available...

Huawei EulerOS: Security Advisory for python-pygments (EulerOS-SA-2024-1162)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

007-nodejs (>=2.5.0 <=2.5.3), 10by10-react-app (=1.2.1) +5570 more potentially affected by CVE-2023-42282 via ip (>=0.0.1 <=1.1.8)

ip NPM version =0.0.1, =2.5.0, =1.0.0, =4.11.0, =1.0.1-5.4, =3.16.2, =3.0.0-beta.22, =3.0.0-beta.22, =3.16.2, =3.16.3, =3.16.2, =3.16.2, =3.0.0-beta.22, =3.16.10 and more Source cves: CVE-2023-42282 Source advisory: OSV:GHSA-78XJ-CGH5-2H22...

CVE-2023-45853 affecting package rubygem-mini_portile2 for versions less than 2.8.0-1

CVE-2023-45853 affecting package rubygem-miniportile2 for versions less than 2.8.0-1. A patched version of the package is available...

CVE-2024-21488

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the childprocess exec function without input sanitization. If attacker-controlled user input is given to the macaddressfor function of the package, it is possible for the attacker to execute...

CVE-2024-21488

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the childprocess exec function without input sanitization. If attacker-controlled user input is given to the macaddressfor function of the package, it is possible for the attacker to execute...

RHCOS 4 : OpenShift Container Platform 4.13.25 (RHSA-2023:7606)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7606 advisory. - haproxy: Proxy forwards malformed empty Content-Length headers CVE-2023-40225 Note that Nessus has not tested for this issue but has instea...

Ubuntu: Security Advisory (USN-6589-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 8 : python-requests (RHSA-2024:0299)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0299 advisory. The python-requests package contains a library designed to make HTTP requests easy for developers. Security Fixes: python-requests: Unintended leak o...

EDK2 Buffer Error Vulnerability

EDK2 is a cross-platform firmware development environment from the Tianocore community based on the UEFI and PI specifications. A security vulnerability exists in EDK2 that stems from Network Package being susceptible to a buffer overflow vulnerability due to the long server ID option in the DHCP...

EulerOS 2.0 SP11 : lua (EulerOS-SA-2023-2697)

According to the versions of the lua package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. CVE-2021-45985 Note that Tenable Network...

EulerOS 2.0 SP11 : avahi (EulerOS-SA-2023-3234)

According to the versions of the avahi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in Avahi. A reachable assertion exists in the avahiescapelabel function. CVE-2023-38470 Note that Tenable Network Securi...

Hardcoded credentials

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens JWTs, allowing them access t...

CVE-2023-46942

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints...

Huawei EulerOS: Security Advisory for python-configobj (EulerOS-SA-2024-1094)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for gcc (EulerOS-SA-2024-1033)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...