5455 matches found
SUSE CVE-2024-53848
check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attack...
GHSA-Q6MV-284R-MP36 check-jsonschema default caching for remote schemas allows for cache confusion
Impact The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attacker can get a user to run check-jsonschema against a malicious schema URL,...
check-jsonschema default caching for remote schemas allows for cache confusion
Impact The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attacker can get a user to run check-jsonschema against a malicious schema URL,...
meltano (>=2.16.0, <=3.6.0b4), nmdc-schema (>=0.0.0, <=7.4.12) +2 more potentially affected by CVE-2024-53848 via check-jsonschema (>=0.19.2, <=0.29.4)
check-jsonschema PYPI version =0.19.2, =2.16.0, =0.0.0, =0.3.0, =0.3.0, =0.4.1 Source cves: CVE-2024-53848 Source advisory: OSV:GHSA-Q6MV-284R-MP36...
meltano (>=2.16.0, <=3.6.0b4), nmdc-schema (>=0.0.0, <=7.4.12) +2 more potentially affected by CVE-2024-53848 via check-jsonschema (>=0.19.2, <=0.29.4)
check-jsonschema PYPI version =0.19.2, =2.16.0, =0.0.0, =0.3.0, =0.3.0, =0.4.1 Source cves: CVE-2024-53848 Source advisory: GHSA-Q6MV-284R-MP36...
CVE-2024-53848
A flaw was found in check-jsonschema. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, for example, https://example.org/schema.json, which will be stored as schema.json. This naming allows for conflicts. If an attacker can get a user to run...
meltano (>=2.16.0, <=3.6.0b4), nmdc-schema (>=0.0.0, <=7.4.12) +2 more potentially affected by CVE-2024-53848 via check-jsonschema (>=0.19.2, <=0.29.4)
check-jsonschema PYPI version =0.19.2, =2.16.0, =0.0.0, =0.3.0, =0.3.0, =0.4.1 Source cves: CVE-2024-53848 Source advisory: SNYK:PYTHON-CHECKJSONSCHEMA-8445277...
Acceptance of Extraneous Untrusted Data With Trusted Data
Overview check-jsonschema is an A jsonschema CLI and pre-commit hook Affected versions of this package are vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data via the default caching mechanism for remote schemas. An attacker can manipulate the cache to insert a malicious schem...
CVE-2024-53848 check-jsonschema default caching for remote schemas allows for cache confusion
check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attack...
CVE-2024-53848
The CVE-2024-53848 issue affects the check-jsonschema tool (and related advisories) where the default caching uses the remote schema basename (e.g., https://example.org/schema.json) as the cache filename. This can allow a malicious schema URL to overwrite or be substituted in the cache leading to...
meltano (>=2.16.0, <=3.6.0b4), nmdc-schema (>=0.0.0, <=7.4.12) +2 more potentially affected by CVE-2024-53848 via check-jsonschema (>=0.19.2, <=0.29.4)
check-jsonschema PYPI version =0.19.2, =2.16.0, =0.0.0, =0.3.0, =0.3.0, =0.4.1 Source cves: CVE-2024-53848 Source advisory: MEND:CVE-2024-53848...
CVE-2024-53848 check-jsonschema default caching for remote schemas allows for cache confusion
check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attack...
PT-2024-35950
Name of the Vulnerable Software and Affected Versions: check-jsonschema versions prior to 0.30.0 Description: The default cache strategy in check-jsonschema uses the basename of a remote schema as the name of the file in the cache. This naming allows for conflicts, enabling an attacker to insert...
Ibexa Admin UI Cross-site Scripting Vulnerability
Ibexa Admin UI is an open source UI interface for Ibexa. It is dedicated to the Ibexa Admin UI Bundle. A cross-site scripting vulnerability exists in Ibexa Admin UI versions prior to v4.6.14, which stems from a cross-site scripting vulnerability in the content name schema...
check-jsonschema security vulnerability
check-jsonschema is a Python + JSON Schema open source CLI for jsonschema validation. A security vulnerability exists in check-jsonschema that stems from a default caching policy that uses the base name of a remote schema as the name of a file in the cache, e.g...
Malicious code in json-schema-editor-visual-yapi (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2c434b89e0272562d45ccf56680fe4b6edf72651ddb2603233fa84ad67bf2c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11047 Malicious code in json-schema-editor-visual-yapi (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2c434b89e0272562d45ccf56680fe4b6edf72651ddb2603233fa84ad67bf2c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in json-schema-editor-visual-yapi
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Hacker in Snowflake Extortions May Be a U.S. Soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake , but a third suspect -- a prolific hacker known as Kiberphant0m -- remains at large and continues to publicly extort victims. However, this person's...
SUSE-SU-2024:4054-1 Security update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop
This update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop fixes the following issues: xmlgraphics-fop was updated from version 2.8 to 2.10: - Security issues fixed: CVE-2024-28168: Fixed improper restriction of XML External Entity XXE reference bsc1231428 -...