MAL-2023-8239 Malicious code in peekatchuysharmlesspackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec4b1b56b3ffd492ba8e5c636c69a6ae9f99bfcee45ee1683293baf6f5d11b9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-36036 · Icu · Icu

Name of the Vulnerable Software and Affected Versions: icu 74 affected versions not specified Description: The issue is related to a crash in the RelativeDateTimeFormatter, specifically in the formatRelativeImpl function. This crash occurs due to an unknown read error. The crash state involves...

CVE-2023-42811 AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext i.e. the correct plaintext is exposed even if tag verification fails. If a program using the aes-gcm...

GHSA-WWFJ-H843-3HRQ FUXA local file inclusion vulnerability

FUXA = 1.1.12 is vulnerable to Local File Inclusion via /api/download...

CVE-2023-43270

dst-admin v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the userId parameter at /home/playerOperate...

CVE-2023-43782

Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created by a local adversary before Cadence started. The adversary can then delete the file, disrupting Cadence...

CVE-2023-4504 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow

Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023...

CVE-2023-42279

Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form...

MAL-2023-8199 Malicious code in @zettle-bo/inventory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6262bbe576936f351b23ae859a7a6109329ac53866ece0189c1a9feee444159 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-28889

Name of the Vulnerable Software and Affected Versions Pillar eve container versions 9.0.0 and later, prior to the inclusion of the config partition measurement in PCR13 Description The Pillar eve container checks for the existence and content of /config/GlobalConfig/global.json on boot. If the fi...

PT-2023-28309 · Mee-Admin · Mee-Admin

Name of the Vulnerable Software and Affected Versions: mee-admin version 1.5 Description: The issue is related to a Directory Traversal vulnerability. The download method in the CommonFileController.java file does not verify the incoming data, resulting in arbitrary file reading. Recommendations:...

DEBIAN-CVE-2023-43377

A cross-site scripting XSS vulnerability in /hoteldruid/visualizzacontratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatarioemail1 parameter...

CVE-2023-43376

A cross-site scripting XSS vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the nometipotariffa1 parameter...

BELL-CVE-2023-3341

Bulletin has no description...

CVE-2023-43616

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction...

The vulnerability of the JDBC client driver of the IBM DB2 database management system allows a hacker to execute arbitrary code.

The vulnerability of the JDBC client driver of the IBM DB2 database management system is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of quality management software for automobile manufacturers, related to the leakage of information in error messages, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the quality management software for automobile manufacturers, QMS Automotive, is related to the leakage of information in error messages. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Magento Open Source affected by Improper Input Validation

Adobe Commerce versions 2.4.3-p1 and earlier and 2.3.7-p2 and earlier are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution...

CVE-2023-5036 Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery CSRF in GitHub repository usememos/memos prior to 0.15.1...

MAL-2023-8142 Malicious code in lodarshe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62e828ed31173431b02c083662f9a335a029b2a2d17878304eaa4e0314f1bf9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...