SUSE-SU-2023:0867-1 Security update for oracleasm

This update of oracleasm fixes the following issues: - rebuild the package with the new secure boot key bsc1209188...

GHSA-6722-XVQ8-3254 SketchSVG Arbitrary Code Injection vulnerability

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string...

PYSEC-2023-298

isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

CVE-2023-23610 glpi vulnerable to Unauthorized access to data export

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

Huawei EulerOS: Security Advisory for gupnp (EulerOS-SA-2022-2613)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in safe-nonce-6218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b26fc284064f9aad0b6e5f8e05c9ee3c7d9642783b8431ac1e90a4bcdfc869a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nexthink/waas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fea500cbd428343297ead9c40ce1377e5a8d3f44b28a33129b2b80fe0cd2e737 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-21589 vulnerabilities

Vulnerabilities for packages: mysql...

Developer account body snatchers pose risks to the software supply chain

Over the past several years, high-profile software supply chain attacks have increased in frequency. These attacks can be difficult to detect and source code repositories became a key focus of this research. Developer account takeovers present a substantial risk to the software supply chain becau...

GHSA-8QV5-68G4-248J vulnerabilities

Vulnerabilities for packages: spark-fips...

CVE-2022-36062 vulnerabilities

Vulnerabilities for packages: grafana-fips...

[SECURITY] Fedora 36 Update: moodle-3.11.10-1.fc36

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators create effective online learning communities...

PYSEC-2022-43099

The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0...

BELL-CVE-2021-3735

Bulletin has no description...

Exploit for Improper Encoding or Escaping of Output in Webmin

A Python script to exploit CVE-202...

Webmin Package Updates Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin Package Updates RCE', 'Description' = %q This module exploits an arbitrary command injection in Webmin versions prior to 1.997. Webmin use...

Webmin Package Updates RCE

This module exploits an arbitrary command injection in Webmin versions prior to 1.997. Webmin uses the OS package manager apt, yum, etc. to perform package updates and installation. Due to a lack of input sanitization, it is possibe to inject arbitrary command that will be concatenated to the...

Malicious code in deere-ui-multiselect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc9d34c6fcae292047f5c4942fc8c169901958ab5f25ab865d02e733c499e5c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in akjpmzcxeynfikob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6fe6a23f3e8d2a0ecd4aca03b55833ce9b00ab53653cdd6d568197f15cc23b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in one-world-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ffa01ed49e6d70a5a5984e7a2dc3d37a03842a5bc1fc3228c997c91ab11d433 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...