apache-ivy: Directory Traversal

A flaw was found in Apache Ivy. With Apache Ivy 2.4.0, an optional packaging attribute was introduced that allows artifacts to be unpacked on the fly if pack200 or zip packaging was used. This issue could allow a malicious used to have unwanted access...

ROS-20230428-05

A vulnerability in Python Packaging Authority installation tools is related to insufficient input validation when processing HTML content. Exploitation of the vulnerability could allow an attacker acting remotely to pass specially crafted data to an application and perform a denial of service...

Oracle MySQL Server (Apr 2023 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging OpenSSL. Supported versions that are affected are 5.7.41 and...

Oracle MySQL Server 5.7.x < 5.7.42 (Apr 2023 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 5.7.41 and...

FreeBSD : py39-setuptools58 -- denial of service vulnerability (24da150a-33e0-4fee-b4ee-2c6b377d3395)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 24da150a-33e0-4fee-b4ee-2c6b377d3395 advisory. - Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of...

nodejs:18 security, bug fix, and enhancement update

An update is available for nodejs, nodejs-packaging, module.nodejs-packaging, module.nodejs-nodemon, nodejs-nodemon, module.nodejs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Security Bulletin: A vulnerability in IBM Java Runtime used by the IBM Installation Manager and IBM Packaging Utility - CVE-2022-21619

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 8 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVE and we recommend updating to the latest version to remediate...

SUSE-SU-2023:1628-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2022-23471: Fixed host memory exhaustion through Terminal resize goroutine leak bsc1206235. - Re-build containerd to use updated golang-packaging jsc1342. - Update to containerd v1.6.16 for Docker v23.0.0-ce...

CVE-2022-37865

A flaw was found in Apache Ivy. With Apache Ivy 2.4.0, an optional packaging attribute was introduced that allows artifacts to be unpacked on the fly if pack200 or zip packaging was used. This issue could allow a malicious used to have unwanted access...

SUSE-SU-2023:1566-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2022-23471: Fixed host memory exhaustion through Terminal resize goroutine leak bsc1206235. - Re-build containerd to use updated golang-packaging jsc1342. - Update to containerd v1.6.16 for Docker v23.0.0-ce...

SUSE-SU-2023:0735-1 Security update for go1.20

This update for go1.20 fixes the following issues: - Improvements to go1.x packaging spec: On Tumbleweed bootstrap with current default gcc13 and gccgo118 On SLE-12 aarch64 ppc64le ppc64 remove overrides to bootstrap using go1.x package %bcondwithout gccgo. This is no longer needed on current...

Medium: python2-setuptools

Issue Overview: Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service ReDoS in packageindex.py. CVE-2022-40897 Affected Packages:...

Malicious code in tppullpyad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6864712bdbeead6f670fbdcef9dc41009b44ef3dddce7361a53badad90fd87b7 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selflgtbpostrand (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b2563ef52025f93e3b6b349de804cf039ace554c5e728cdbeb4a7a95ad299a74 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-httptoolstring (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4a918486a893a920f81240ff79d805ea13d3cebf95fe4334872ac030554a465c EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-intelmcad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 46bd7cf9b0fb3f5b136e34f174b4f0a0f5755d0041a8d0a9b411f9390e4c1a16 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqrepullstring (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx db49c4ba3c6632bef1000d5fd10a3bb485273ce59377b605ae18e3a24d72ae9b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfcraftsuperhacked (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4c306a77e3cf5fd1d9dd6eec655a6078325cc089b3f3d3376df0bdde6bbf9bfa EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tppushcpucandy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx db3846a8f57d90175da1688f15191dfe3940d84468e66509f269aad0cf77829f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-studypostgame (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 781d924bc6b7abbb493ef4d5ed554229b1669af03ec7bee2d0a2744fb6c659f0 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...