EUVD-2023-0214

Malicious code in bioql PyPI...

CVE-2023-26145

This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke and pydash.collections.invokemap accept dotted paths Deep Path Strings to target a nested Python object, relative to the original source object. These paths can be used to target...

openSUSE Security Advisory (SUSE-SU-2024:1639-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:1639-2 Security update for python-arcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack, python-marshmallow, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-opentelemetry-sdk, python-opentelemetry-semantic-conventions, python-opentelemetry-test-utils, python-pycomposefile, python-pydash, python-redis, python-retrying, python-semver, python-sshtunnel, python-strictyaml, python-sure, python-vcrpy, python-xmltodict

This update for python-argcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack,...

SUSE-SU-2024:1639-1 Security update for python-arcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack, python-marshmallow, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-opentelemetry-sdk, python-opentelemetry-semantic-conventions, python-opentelemetry-test-utils, python-pycomposefile, python-pydash, python-redis, python-retrying, python-semver, python-sshtunnel, python-strictyaml, python-sure, python-vcrpy, python-xmltodict

This update for python-argcomplete, python-Fabric, python-PyGithub, python-antlr4-python3-runtime, python-avro, python-chardet, python-distro, python-docker, python-fakeredis, python-fixedint, python-httplib2, python-httpretty, python-javaproperties, python-jsondiff, python-knack,...

Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed these vulnerabilities with an update. Vulnerability Details CVEID:CVE-2023-41419 DESCRIPTION: Gevent could allow a remote attacker to gain...

Security Bulletin: Pydash is vulnerable to CVE-2023-26145 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses pydash, which is vulnerable to CVE-2023-26145. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-26145 DESCRIPTION: Python pydash package could allow a remote attacker to...

Command Injection

pydash is vulnerable to Command Injection. The vulnerability is due to the basegetobject function in helpers.py which retrieves the value of a given key from an object. If it doesn't find a specified key in an object, it tries to access the object's attributes directly. This allows attackers to...

beep (>=2021.5.18.10, <=2021.6.3.21), easiersdk (>=0.1.15, <=0.1.16) +2 more potentially affected by CVE-2023-26145 via pydash (5.0.0)

pydash PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - beep =2021.5.18.10, =0.1.15, =0.9.0, =0.9.4 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

beep (>=2021.7.21.14, <=2021.9.30.15), gstorm (>=0.6.3, <=0.10.1) +2 more potentially affected by CVE-2023-26145 via pydash (5.0.2)

pydash PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - beep =2021.7.21.14, =0.6.3, =2.0.4, =3.0.4 - valiotworker 5.0.3 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

arcus (>=0.2.6, <=1.2.4), pano (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2023-26145 via pydash (4.7.4)

pydash PYPI version 4.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - arcus =0.2.6, =2.0.0, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

arcus (>=0.2.7, <=1.2.2), bolinette (>=0.0.20, <=0.1.4) +4 more potentially affected by CVE-2023-26145 via pydash (4.7.6)

pydash PYPI version 4.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - arcus =0.2.7, =0.0.20, =0.21.0, =1.0.0a1, =0.4.10, =0.0.2, =1.2.1 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

arcus (>=1.2.7, <=1.2.8.dev0), dialogy (>=0.3.7, <=2.2.1) +10 more potentially affected by CVE-2023-26145 via pydash (4.9.3)

pydash PYPI version 4.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - arcus =1.2.7, =0.3.7, =2.0.0rc1, =2.3.0, =0.10.0, =1.0.0, =0.12.0, =0.0.4, =0.0.64 - tog 0.3.0 - vivaldi 0.2.1 Source cves: CVE-2023-26145 Source...

ethyca-fides (>=1.9.9, <=2.7.1), meld-sandbox (>=1.0.0, <=2.7.8) potentially affected by CVE-2023-26145 via pydash (5.1.1)

pydash PYPI version 5.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - ethyca-fides =1.9.9, =1.0.0, =2.7.8 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

sphinx-markdown-builder (>=0.5.0, <=0.5.1) potentially affected by CVE-2023-26145 via pydash (4.7.5)

pydash PYPI version 4.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - sphinx-markdown-builder =0.5.0, =0.5.1 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

arcus (1.2.5), gstorm (>=0.5.0, <=0.6.1) +2 more potentially affected by CVE-2023-26145 via pydash (4.8.0)

pydash PYPI version 4.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - arcus 1.2.5 - gstorm =0.5.0, =0.1.1, =2.0.0, =2.0.3 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

anydb (>=0.1.0, <=0.3.3), beep (>=2020.7.8, <=2020.11.19.17) +3 more potentially affected by CVE-2023-26145 via pydash (4.5.0)

pydash PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - anydb =0.1.0, =2020.7.8, =0.2.0, =0.0.1, =0.1.0, =0.2.10 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

mockgen (0.0.1), nailpack-flask (0.1.0) +1 more potentially affected by CVE-2023-26145 via pydash (4.2.1)

pydash PYPI version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - mockgen 0.0.1 - nailpack-flask 0.1.0 - nails 0.2.0 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...

algora-sdk (>=1.3.2, <=1.5.39), battetl (>=1.0.1, <=1.1.4) +8 more potentially affected by CVE-2023-26145 via pydash (5.1.0)

pydash PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - algora-sdk =1.3.2, =1.0.1, =2021.10.11.13, =0.0.1b0, =0.30.0, =0.9.9, =1.3.0, =1.1.0, =1.1.1 - xdeen 0.0.1 Source cves: CVE-2023-26145 Source...

cfoundation (0.1.0), dados (>=0.1.0, <=0.1.4) +1 more potentially affected by CVE-2023-26145 via pydash (4.3.0)

pydash PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydash and may be impacted: - cfoundation 0.1.0 - dados =0.1.0, =0.1.4 - lasso-cli 0.0.1 Source cves: CVE-2023-26145 Source advisory: OSV:GHSA-8MJR-6C96-39W8...