MAL-2023-1445 Malicious code in fiji-core-pal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b28ba0a33259d58a30bc38f6d3444c0677f33e3eda42538f3a1114a9191e7ce0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Moq v4.20.0-rc to 4.20.1 share hashed user data

Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this. Moq v4.20.2 has removed this functionality...

CVE-2023-39977

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3268. Reason: This candidate is a reservation duplicate of CVE-2023-3268. Notes: All CVE users should reference CVE-2023-3268 instead of this candidate. All references and descriptions in this candidate have been removed to...

Apache Airflow Execution with Unnecessary Privileges

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the...

CVE-2023-39508 Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the...

AZL-35126 CVE-2023-37920 affecting package python-certifi for versions less than 2023.05.07-1.cm2

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted ...

PT-2023-24666 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: Strapi versions prior to 4.10.8 Description: The issue affects the handling of content types by Strapi, allowing anyone to make every attribute of a Content-Type public without knowing it. This can lead to sensitive information being exposed ...

MAL-2023-459 Malicious code in fr-config-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a3e96cb06aafc753b8adb69cabd8145c6125d89151ff1556f3685e0a99e9e84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-402 Malicious code in fca-itadori (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df106db3a560eacff2bd60a5212b08b53adce6e3763e9a554f09ed0c3c896e71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2023-1688068314 mysql: Fix of 37 CVEs

Update to MySQL 8.0.32 - CVEs fixed: CVE-2023-21912 CVE-2022-21594 CVE-2022-21599 CVE-2022-21604 CVE-2022-21608 CVE-2022-21611 CVE-2022-21617 CVE-2022-21625 CVE-2022-21632 CVE-2022-21633 CVE-2022-21637 CVE-2022-21640 CVE-2022-39400 CVE-2022-39408 CVE-2022-39410 CVE-2023-21836 CVE-2023-21863...

MAL-2023-215 Malicious code in criteo-static-variables-datasource (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65ae832c9a084b0c39c57bf3bb68ff1877e5f1370b9c29e564368e0a2d224d9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-19967 · Nokia · Nokia Airscale Asika Single Ran +1

Name of the Vulnerable Software and Affected Versions: NOKIA Airscale ASIKA Single RAN devices versions prior to 21B Description: An issue was discovered in the Nokia BTS baseband unit diagnostic tool AaShell, which is disabled by default. If security hardenings are removed from a Nokia Single RA...

MAL-2023-357 Malicious code in fc-mijn-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1239e10e2e52412b4a13dac91c28d9b96d0b6d6e79213b3d9a80d394f8e768f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-337 Malicious code in fc-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f572d0c49001777d7ebfe2df3171692e6f0cc1814541312cfb9b2adbbb0c6335 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-609 Malicious code in multivariate-experiments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43ad874c630ddc5086d622b1f450560f76c8b2d874591884b3265450f0aad747 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2023-2483

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of this candidate. All references and descriptions in this candidate have been removed t...

USN-6073-8 nova regression

USN-6073-3 fixed a vulnerability in Nova. Unfortunately the update introduced a regression with detaching volumes. The security fix has been removed pending further investigation. We apologize for the inconvenience. Original advisory details: Jan Wasilewski and Gorka Eguileor discovered that Nova...

USN-6073-7 python-glance-store regression

USN-6073-2 fixed a vulnerability in Glancestore. Unfortunately the update introduced a regression with detaching volumes. The security fix has been removed pending further investigation. We apologize for the inconvenience. Original advisory details: Jan Wasilewski and Gorka Eguileor discovered th...

USN-6093-1 linux-bluefield vulnerabilities

It was discovered that the Traffic-Control Index TCINDEX implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the...

PT-2023-23951 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.3.8 Description: In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked nonpayable. This issue was fixed by the remov...