16961 matches found
Security Bulletin: Cloud Pak System is vulnerable to Node.js ReDos (CVE-2022-25883)
Summary ReDos vulnerability found in semver Node.js package affects Cloud Pak System. IBM Cloud Pak System Software has addressed this vulnerability. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package is vulnerable to a denial of service, caused by a regular expression...
GHSA-762M-4CX6-6MF4 Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling
Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled...
Mattermost failed to disallow the modification of local users when syncing users in shared channels
Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user...
CVE-2024-39832 Permanently local data deletion by malicious remote
Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled...
Prototype Pollution
@chasemoskal/snapstate is vulnerable to Prototype Pollution. The vulnerability is due to passing arguments crafted with the built-in property proto to the function attemptNestedProperty, which allows an attacker to alter the behavior of all objects inheriting from the affected prototype and...
MAL-2024-7875 Malicious code in boostrapsio (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d56d7ae2cc50c737f4b7272c51fef0ec9899e899d19628763c3aa6aad5dfef1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
ASB-A-336648613
In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
GHSA-P9W4-585H-G3C7 biscuit-auth vulnerable to public key confusion in third party block
Third-party blocks can be generated without transferring the whole token to the third-party authority. Instead, a ThirdPartyBlock request can be sent, providing only the necessary info to generate a third-party block and to sign it: - the public key of the previous block used in the signature - t...
BELL-CVE-2024-42228
Bulletin has no description...
BELL-CVE-2024-42225
Bulletin has no description...
BELL-CVE-2024-42223
Bulletin has no description...
BELL-CVE-2024-42161
Bulletin has no description...
BELL-CVE-2024-42162
Bulletin has no description...
BELL-CVE-2024-42158
Bulletin has no description...
BELL-CVE-2024-42155
Bulletin has no description...
BELL-CVE-2024-42154
Bulletin has no description...
BELL-CVE-2024-42147
Bulletin has no description...
BELL-CVE-2024-42143
Bulletin has no description...