MAL-2023-1260 Malicious code in orbit-themer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e59310eaedaf4f0aea5f0369808690dc45cb900d5acc5f22ba9503d8b1515421 The OpenSSF Package Analysis project identified 'orbit-themer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

GLPI vulnerable to unauthorized access to KnowbaseItem data

[email protected] reports: GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version...

SUSE-SU-2023:2665-1 Security update for cosign

This update of cosign fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

CVE-2023-2878 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver, vault-csi-provider...

CVE-2023-33959 vulnerabilities

Vulnerabilities for packages: zot...

CVE-2023-31124 vulnerabilities

Vulnerabilities for packages: c-ares...

Malicious code in marathi_chawat_katha_mck_comics_by_24_gw97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8f2db052000fc6063f23b25b1e074b2c97af8149bd18b477e91746e4b2b803a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-28639

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is...

CVE-2023-28636

GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7...

CVE-2023-28639

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is...

CVE-2023-28849

CVE-2023-28849 affects GLPI prior to 10.0.7 where the inventory endpoint allows unauthenticated access enabling SQL injection and potential XSS; GLPI 10.0.7 patches the issue, with a workaround to disable native inventory. Additional connected PT Security entries describe related SQLi and SSRF/XS...

CVE-2023-28636

GLPI vulnerability CVE-2023-28636 affects GLPI versions before 9.5.13 and 10.0.7 (starting from version 0.60). An administrator can create a malicious external link due to the flaw, with fixes implemented in 9.5.13 and 10.0.7. Exploitation details are not described in the provided documents beyon...

CVE-2023-0056 vulnerabilities

Vulnerabilities for packages: haproxy...

SUSE-SU-2023:0867-1 Security update for oracleasm

This update of oracleasm fixes the following issues: - rebuild the package with the new secure boot key bsc1209188...

GHSA-6722-XVQ8-3254 SketchSVG Arbitrary Code Injection vulnerability

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string...

PYSEC-2023-298

isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF...

CVE-2023-23610 glpi vulnerable to Unauthorized access to data export

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

Huawei EulerOS: Security Advisory for gupnp (EulerOS-SA-2022-2613)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in safe-nonce-6218 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b26fc284064f9aad0b6e5f8e05c9ee3c7d9642783b8431ac1e90a4bcdfc869a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nexthink/waas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fea500cbd428343297ead9c40ce1377e5a8d3f44b28a33129b2b80fe0cd2e737 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...