15736 matches found
CVE-2024-47179
RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's docker-test-cont.yml workflow is vulnerable to Artifact Poisoning, which could have lead to a full repository takeover. Downstream users of RSSHub are not vulnerable to this issue, and commit 64e00e7 fixed the underlying issue and made t...
CVE-2024-47179 RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover.
RSSHub is an RSS network. Prior to commit 64e00e7, RSSHub's docker-test-cont.yml workflow is vulnerable to Artifact Poisoning, which could have lead to a full repository takeover. Downstream users of RSSHub are not vulnerable to this issue, and commit 64e00e7 fixed the underlying issue and made t...
CVE-2024-47197 Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials
Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype...
RSSHub 输入验证错误漏洞
RSSHub is the world's largest RSS network open-sourced by DIYgod, consisting of over 5000 global instances. RSSHub suffers from an input validation error vulnerability that stems from the vulnerability of RSSHub's docker-test-cont.yml workflow to a poisoning attack, which could lead to a takeover...
Apache Maven Archetype Plugin 安全漏洞
Apache Maven Archetype Plugin is a tool from the Apache USA Foundation. It allows users to create Maven projects from existing templates called archetypes. A security vulnerability exists in Apache Maven Archetype Plugin versions 3.2.1 through 3.3.0, which stems from the fact that the Archetype...
PT-2024-32460 · Rsshub · Rsshub
Name of the Vulnerable Software and Affected Versions: RSSHub versions prior to commit 64e00e7 Description: RSSHub's docker-test-cont.yml workflow is vulnerable to Artifact Poisoning, which could have led to a full repository takeover. The workflow gets triggered when the PR - Docker build test...
Malicious code in k0m3g4-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bd260efc78494efc57d67f6576d7ae30b8e58e866ee7a3c228692548174c1e19 The OpenSSF Package Analysis project identified 'k0m3g4-test' @ 2.999.0 npm as malicious. It is considered malicious because: - The package...
MAL-2024-8975 Malicious code in test-object-model (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19a8444231c11ecbd30418a30d5b3805f87015c6ca2683784be6685ef4c77c25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in test-object-model (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19a8444231c11ecbd30418a30d5b3805f87015c6ca2683784be6685ef4c77c25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
kernel: dm: call the resume method on internal suspend
A flaw was found in the Linux kernel’s device-mapper dm component. The issue arises during internal suspend operations where the resume method is not correctly called. This issue leads to problems such as list corruption, specifically observed when running the lvm2 test suite. The problem occurs...
expat security update
2.2.5-15.0.1 - lib: Prevent integer overflow in doProlog CVE-2022-23990Orabug: 33910314 2.2.5-15 - Rebuild for test reconfiguration 2.2.5-14 - Fix multiple CVEs - Fix CVE-2024-45492 integer overflow - Fix CVE-2024-45491 Integer Overflow or Wraparound - Fix CVE-2024-45490 Negative Length Parsing...
[SECURITY] Fedora 40 Update: python3.9-3.9.20-1.fc40
Python 3.9 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.9, see other distributions that support it, such as CentOS or RHEL or older Fedo...
[SECURITY] Fedora 40 Update: python3.8-3.8.20-1.fc40
Python 3.8 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.8, see other distributions that support it, such as an older Fedora release...
[SECURITY] Fedora 39 Update: python3.9-3.9.20-1.fc39
Python 3.9 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.9, see other distributions that support it, such as CentOS or RHEL or older Fedo...
SUSE CVE-2024-46754
In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tstrun from lwtseg6localprogops. The syzbot reported that the lwtseg6 related BPF ops can be invoked via bpftestrun without without entering inputactionendbpf first. Martin KaFai Lau said that self test for...
Malicious code in shopify-app-session-storage-test-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cf57abdb74d18055d8c4a31ab0fe3fb4fe3553670523254373ae3cd9a03d53d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-8921 Malicious code in shopify-app-session-storage-test-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cf57abdb74d18055d8c4a31ab0fe3fb4fe3553670523254373ae3cd9a03d53d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
DEBIAN-CVE-2024-46754
In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tstrun from lwtseg6localprogops. The syzbot reported that the lwtseg6 related BPF ops can be invoked via bpftestrun without without entering inputactionendbpf first. Martin KaFai Lau said that self test for...
AZL-68297 CVE-2024-46754 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tstrun from lwtseg6localprogops. The syzbot reported that the lwtseg6 related BPF ops can be invoked via bpftestrun without without entering inputactionendbpf first. Martin KaFai Lau said that self test for...
AZL-62615 CVE-2024-46754 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tstrun from lwtseg6localprogops. The syzbot reported that the lwtseg6 related BPF ops can be invoked via bpftestrun without without entering inputactionendbpf first. Martin KaFai Lau said that self test for...