Security Bulletin: Multiple vulnerabilities in IBM Aspera Orchestrator

Summary Multiple vulnerabilities were addressed in IBM Aspera Orchestrator 4.1.5 Vulnerability Details CVEID:CVE-2026-41316 DESCRIPTION: ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in ERBresult and ERBr...

WS-2023-0250

"sweetalert2" versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme...

Malware in next-sweetalert2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in next-sweetalert2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8045e5172fb2ccb88fcd16b2a66207ca2896e30031828b942dffcf423ebbb6d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@bnsights-test/test-admin-portal (>=0.0.4, <=0.0.147), @bnsights-test/test-controls (>=0.0.4, <=0.0.63) +27 more potentially affected by unknown CVE via sweetalert2 (>=11.6.15, <=11.22.3)

sweetalert2 NPM version =11.6.15, =0.0.4, =0.0.4, =1.0.0, =1.0.110, =0.0.0-20240903040200, =1.10.0, =15.2.16, =1.0.1, =1.1.16, =1.1.25, =1.0.25, =1.0.17, =1.0.0, =2.0.8, =2.1.5 and more Source cves: unknown CVE Source advisory: GHSA-MRR8-V49W-3333...

@bnsights-test/test-admin-portal (>=0.0.4, <=0.0.147), @bnsights-test/test-controls (>=0.0.4, <=0.0.63) +27 more potentially affected by unknown CVE via sweetalert2 (>=11.6.15, <=11.22.3)

sweetalert2 NPM version =11.6.15, =0.0.4, =0.0.4, =1.0.0, =1.0.110, =0.0.0-20240903040200, =1.10.0, =15.2.16, =1.0.1, =1.1.16, =1.1.25, =1.0.25, =1.0.17, =1.0.0, =2.0.8, =2.1.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MRR8-V49W-3333...

GHSA-MRR8-V49W-3333 sweetalert2 contains potentially undesirable behavior

sweetalert2 versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme...

sweetalert2 contains potentially undesirable behavior

sweetalert2 versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme...

PT-2023-33044 · Unknown · Sweetalert2

Name of the Vulnerable Software and Affected Versions: sweetalert2 versions 11.6.14 and above Description: The sweetalert2 package exhibits potentially undesirable behavior by outputting audio and/or video messages unrelated to its functionality when run on specific top-level domains TLDs. This...

@abacollection/assets (1.2.0), @action.sustainability/storybook-dashboard (>=0.1.0, <=0.3.95) +300 more potentially affected by unknown CVE via sweetalert2 (8.19.1)

sweetalert2 NPM version 8.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on sweetalert2 and may be impacted: - @abacollection/assets 1.2.0 - @action.sustainability/storybook-dashboard =0.1.0, =1.0.0, =0.11.0, =0.0.0-beta.2, =0.0.5, =0.0.1, =1.0.0,...

sweetalert2 v8.19.1 and above contains hidden functionality

sweetalert2 versions 8.19.1 and up until 9.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions below 8.19.1. Workaround Users who a...

@1doc3/hermes-chat (>=0.0.0, <=0.4.74), @1doc3/synapse-wizard (>=0.0.0, <=0.5.119) +625 more potentially affected by unknown CVE via sweetalert2 (>=8.19.1, <=11.22.3)

sweetalert2 NPM version =8.19.1, =0.0.0, =0.0.0, =0.1.0, =2.31.0, =0.0.1-beta.1, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =0.0.9, =0.0.1, =0.3.73, =0.3.198 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8JH9-WQPF-Q52C...

@airgap/beacon-sdk (>=0.0.1-beta.1, <=0.0.1-beta.8), @alicornlabs/labs-design (>=0.1.1, <=0.1.3) +136 more potentially affected by unknown CVE via sweetalert2 (9.17.4)

sweetalert2 NPM version 9.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on sweetalert2 and may be impacted: - @airgap/beacon-sdk =0.0.1-beta.1, =0.1.1, =1.0.1, =1.0.0, =0.0.9, =1.0.0, =2.6.7, =1.0.4, =1.0.0, =2.0.1, =0.10.0, =2.0.0, =2.0.1, =1.1.3,...

sweetalert2 v9.17.4 and above contains hidden functionality

sweetalert2 versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 9.0.0 - 9.17.3. Workaround Users wh...

@1doc3/hermes-chat (>=0.0.0, <=0.4.74), @1doc3/synapse-wizard (>=0.0.0, <=0.5.119) +327 more potentially affected by unknown CVE via sweetalert2 (>=9.17.4, <=11.22.3)

sweetalert2 NPM version =9.17.4, =0.0.0, =0.0.0, =2.31.0, =0.0.1-beta.1, =0.1.1, =1.0.1, =1.0.0, =0.0.9, =0.0.1, =0.3.73, =0.0.4, =0.0.4, =1.0.0, =1.0.17, =1.2.34 and more Source cves: unknown CVE Source advisory: OSV:GHSA-PG98-6V7F-2XFV...

GHSA-PG98-6V7F-2XFV sweetalert2 v9.17.4 and above contains hidden functionality

sweetalert2 versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 9.0.0 - 9.17.3. Workaround Users wh...

GHSA-457R-CQC8-9VJ9 sweetalert2 v10.16.10 and above contains hidden functionality

sweetalert2 versions 10.16.10 and up until 11.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 10.0.0 - 10.16.9. Workaround Use ...

sweetalert2 v10.16.10 and above contains hidden functionality

sweetalert2 versions 10.16.10 and up until 11.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 10.0.0 - 10.16.9. Workaround Use ...

@aiguesdebarcelona/ab-ofex-components (>=2.31.0, <=3.18.0), @charescape/js-utils-proj (>=1.3.0, <=1.3.1) +112 more potentially affected by unknown CVE via sweetalert2 (10.16.11)

sweetalert2 NPM version 10.16.11 is affected by a known vulnerability. The following packages have a transitive dependency on sweetalert2 and may be impacted: - @aiguesdebarcelona/ab-ofex-components =2.31.0, =1.3.0, =1.0.1, =1.0.4, =0.1.0, =0.1.0-alpha.0, =1.0.1-beta-development, =0.0.2, =1.1.30,...

@1doc3/hermes-chat (>=0.0.0, <=0.4.74), @1doc3/synapse-wizard (>=0.0.0, <=0.5.119) +195 more potentially affected by unknown CVE via sweetalert2 (>=10.16.11, <=11.22.3)

sweetalert2 NPM version =10.16.11, =0.0.0, =0.0.0, =2.31.0, =1.0.0, =0.0.1, =0.3.73, =0.0.4, =0.0.4, =1.0.0, =1.0.17, =0.0.0-20240903040200, =1.3.0, =1.10.0, =1.0.1, =1.1.333 and more Source cves: unknown CVE Source advisory: OSV:GHSA-457R-CQC8-9VJ9...