GHSA-3633-5H82-39PQ Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata

Issue If an attacker is able to control a threshold of keys to insert the same public key more than once with different key IDs into signed, trusted metadata on a TUF repository, then go-tuf clients 0.3.2 are susceptible to an attack where attackers can cause the same signature from the same publ...

GHSA-R7VQ-6425-J94W Python-TUF vulnerable to incorrect threshold signature computation for new root metadata

Impact The function verifyrootselfsigned, introduced in v0.14.0, and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towards the new threshold. That is, any single new root key could theoretically provide enough signatures to meet the...

Venice vulnerable to Partial Path Traversal issue within the functions `load-file` and `load-resource`

Impact A partial path traversal issue exists within the functions load-file and load-resource. These functions can be limited to load files from a list of load paths. Assuming Venice has been configured with the load paths: "/Users/foo/resources" When passing relative paths to these two vulnerabl...

RUSTSEC-2022-0088 `tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope

It is possible for readDir to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in this issue. This is corrected in this PR by checking if a directory is a symlink before reading from it...

`tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope

It is possible for readDir to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in this issue. This is corrected in this PR by checking if a directory is a symlink before reading from it...

CVE-2021-32771 Buffer overflow in contiki-ng

Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have...

curitiba.pr.gov.br Cross Site Scripting vulnerability OBB-2749434

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-31935

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.198 Description The issue is related to kernfs, where kernfs pr cont buf and rename lock are separated. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-31731

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.122 Description The issue is related to kernfs, where kernfs pr cont buf and rename lock are not properly separated. This is an automated identification of a potential security issue, but the actual impact...

Malicious code in check-pr-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0961e1ec14afe7f9d5370e706429bdc66c4b03ca6d4cc94b81c4a5c7deaaa031 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5335 Malicious code in ping-on-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3207a9a6ac9717095c2d6763f67b2f2c915a109c1c32ebb48e28a68753aa11d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ping-on-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3207a9a6ac9717095c2d6763f67b2f2c915a109c1c32ebb48e28a68753aa11d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6229 Malicious code in spark-pr-board (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120c6f6b14abe7ae9c2ac0f2e14844f9f2cd26b7cf7b33a677e013d0f6db4891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spark-pr-board (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120c6f6b14abe7ae9c2ac0f2e14844f9f2cd26b7cf7b33a677e013d0f6db4891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-831 Malicious code in action-create-release-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1f9c096fa3bf9d38477488398a8d49d517f96c85896b4312ef8e8771336c43a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in assign-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62e185441fd99093a564a1a297859285aaf49df491f7beb894114173c842fd0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1144 Malicious code in assign-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62e185441fd99093a564a1a297859285aaf49df491f7beb894114173c842fd0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Design/Logic Flaw

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...

CVE-2022-29220

CVE-2022-29220 concerns the github-action-merge-dependabot GitHub Action. Prior to version 3.2.0, it does not verify that commits created by dependabot are signed with the correct GPG key; it only checks that the PR actor is dependabot[bot]. This enables a threat actor with access to the pipeline...

CVE-2022-29220 No verification of commits origin in github-action-merge-dependabot

github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...