CVE-2024-47080 matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061 and is commonly used to...

CVE-2024-47080

Removed by vendor...

PT-2024-9364 · Pdfl Sdk · Pdfl Sdk

Name of the Vulnerable Software and Affected Versions: PDFL SDK versions 21.0.0.5 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

VulnCheck KEV: CVE-2022-4974

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the getdebuglog, getdboption, and the setdboption functions in versions up...

matrix-js-sdk 信息泄露漏洞

matrix-js-sdk is an application component of Matrix open source. An information disclosure vulnerability exists in matrix-js-sdk, which stems from the MatrixClient.sendSharedHistoryKeys function being susceptible to interception by a malicious master server...

matrix-react-sdk 信息泄露漏洞

matrix-react-sdk is a Matrix open source component for inserting the Matrix chat/voip client into web pages. An information disclosure vulnerability exists in matrix-react-sdk, which stems from the fact that matrix-react-sdk shares a history message key at invite time...

Security Update for Microsoft .NET Core SDK (July 2024)

The version of .NET Core SDK installed on the remote host is 6.x prior to 6.0.32. It is, therefore, affected by remote code execution vulnerability as referenced in the July 2024 advisory: - .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability CVE-2024-38081 Note that Ness...

Important: Red Hat Security Advisory: .NET 6.0 security update

An update for .NET 6.0 is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact

Summary IBM® SDK Java™ Technology Edition is shipped as a component of IBM Tivoli Netcool Impact. IBM Tivoli Netcool Impact has addressed the applicable issues, CVE-2023-22081, CVE-2023-22067, and CVE-2023-5676 Vulnerability Details CVEID:CVE-2024-21147 DESCRIPTION: An unspecified vulnerability i...

RHEL 9 : .NET 6.0 (RHSA-2024:8048)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8048 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

RHEL 9 : .NET 6.0 (RHSA-2024:8047)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8047 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

OESA-2024-2227 avro security update

Apache Avro is a data serialization system. Security Fixes: Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.CVE-2024-47561...

Security Bulletin: There are multiple vulnerabilities that affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition.

Summary There are multiple vulnerabilities that affect CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition. Updates for CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition have been released to address these vulnerabilities...

Security Update for Microsoft .NET Core SDK (October 2024)

The version of .NET Core SDK installed on the remote host is 6.x prior to 6.0.35 or 8.x prior to 8.0.10. It is, therefore, affected by denial of service vulnerability as referenced in the October 2024 advisory: - .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability...

Security Update for Microsoft .NET Core SDK (CVE-2024-38229) (October 2024)

The version of .NET Core SDK installed on the remote host is 8.x prior to 8.0.10. It is, therefore, affected by remote code execution vulnerability as referenced in the October 2024 advisory: - .NET and Visual Studio Remote Code Execution Vulnerability CVE-2024-38229 Note that Nessus has not test...

Malicious code in @copilot-web-widgets/common-core-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 148c6b43da3f4ec787aa611cf721a390eab6918627604a9405d817955e2c472b The OpenSSF Package Analysis project identified '@copilot-web-widgets/common-core-sdk' @ 1.11.0 npm as malicious. It is considered malicious...

Malicious code in sendbird_chat_sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4235262a616f13a56e19ff50a343529ab7aad26e053bedda928754ea56e064a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Linux 9 : .NET / 6.0 (ELSA-2024-7867)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-7867 advisory. 6.0.135-1.0.1 - Add support for Oracle Linux 6.0.135-1 - Update to .NET SDK 6.0.135 and Runtime 6.0.35 - Resolves: RHEL-60798 6.0.134-1 - Update to .NE...

Malicious code in buy-sell-opensea-sdk-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 387f6a252dc97ef83ae3456d6a7d81fa5f49202e6cd416597e3d07d7317ae014 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9136 Malicious code in buy-sell-opensea-sdk-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 387f6a252dc97ef83ae3456d6a7d81fa5f49202e6cd416597e3d07d7317ae014 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...