azureml-designer-pytorch-modules (>=0.0.1, <=0.0.12), deberta (0.1.4) +10 more potentially affected by CVE-2024-31580 via torch (1.3.0)

torch PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - azureml-designer-pytorch-modules =0.0.1, =0.0.3, =1.3.0, =0.1.0, =0.1.0, =0.2.0a2, =0.1.0, =0.1.1 Source cves: CVE-2024-31580 Source advisory:...

lightwood (>=0.6.6, <=0.6.7), pytorch-tabnet (>=0.1.0, <=0.1.2) +1 more potentially affected by CVE-2024-31583 via torch (1.0.1)

torch PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on torch and may be impacted: - lightwood =0.6.6, =0.1.0, =0.1.2 - syft 0.1.13a1 Source cves: CVE-2024-31583 Source advisory: OSV:PYSEC-2024-251...

CVE-2024-29018 vulnerabilities

Vulnerabilities for packages: trivy, kargo, spire-server, grype, melange, wolfictl, kaniko, zot, ko, loki, cilium-cli, crossplane, prometheus, spire-server-fips, aactl, conftest, dagger, buf, kubescape, docker-compose, up, buildkitd, ctop, syft, conftest-fips, cadvisor, cadvisor-fips, tkn...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: trivy, kargo, spire-server, grype, melange, wolfictl, kaniko, zot, ko, loki, cilium-cli, crossplane, prometheus, spire-server-fips, aactl, conftest, dagger, buf, kubescape, docker-compose, up, buildkitd, ctop, syft, conftest-fips, cadvisor, cadvisor-fips, tkn...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: trivy, k3s, k3d, grype, newrelic-infrastructure-agent, podman, runc, docker, k9s, kaniko, wolfictl, kots, zot, zarf, skaffold, kubernetes, skopeo, nerdctl, kubescape, buildkitd, ctop, syft, cadvisor...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, k3s, wolfictl, zarf, k3d, ctop, nerdctl, kots, grype, kaniko, kubernetes, skaffold, docker, trivy, runc, syft, cadvisor, podman, kubescape, buildkitd, zot, k9s, skopeo...

CVE-2024-24579 vulnerabilities

Vulnerabilities for packages: grype, kubescape, wolfictl, zarf, k9s, syft...

CVE-2024-24579 vulnerabilities

Vulnerabilities for packages: zarf, kubescape, grype, syft, wolfictl, k9s...

ax-env (>=0.2.2, <=0.3.1), fb-sapp (>=0.5.3, <=0.5.4) +4 more potentially affected by CVE-2022-4899 via zstd (>=1.4.4.0, <=1.5.2.6)

zstd PYPI version =1.4.4.0, =0.2.2, =0.5.3, =0.0.1a0, =1.0.0rc1, =1.3.0 Source cves: CVE-2022-4899 Source advisory: OSV:GHSA-5C9C-6X87-F9VM...

SUSE CVE-2023-24827

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set

A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. Impact The SYFTATTESTPASSWORD environment variable is for the syft attest command to generate attested SBOMs for the given container image...

GHSA-JP7V-3587-2956 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set

A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. Impact The SYFTATTESTPASSWORD environment variable is for the syft attest command to generate attested SBOMs for the given container image...

Information Disclosure

github.com/anchore/syft is vulnerable to Information Disclosure. The vulnerability exists due to the SYFTATTESTPASSWORD environment variable in the syft logs leaking when -vv or -vvv are used in the syft command which is any log level = DEBUG and in the attestation or SBOM only when the syft-json...

CVE-2023-24827

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

CVE-2023-24827

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

Design/Logic Flaw

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

CVE-2023-24827 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

CVE-2023-24827

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

CVE-2023-24827

Syft (CLI + Go library for SBOMs) had a password disclosure vulnerability in v0.69.0–v0.69.1 where SYFT_ATTEST_PASSWORD could leak credentials in logs (DEBUG+ levels) and in attestations/SBOM payloads when using syft-json. The issue affects users who set SYFT_ATTEST_PASSWORD; users without it are...