Malicious Package

Overview en-thrift-internal is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview evernote-thrift is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious code in @thrift-api/request (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc7c546cee9e2a91fe9d45f7f261892c3bfb7d979a727786c4f77d1ac0be7e16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-639 Malicious code in @thrift-api/drivertrade-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48fc4d9be4686667e8cfc3eddb9dd82bfdc9173ecc3ae88f35e626e66e515e68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-640 Malicious code in @thrift-api/request (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc7c546cee9e2a91fe9d45f7f261892c3bfb7d979a727786c4f77d1ac0be7e16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @thrift-api/drivertrade-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48fc4d9be4686667e8cfc3eddb9dd82bfdc9173ecc3ae88f35e626e66e515e68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in thrift-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da73b51938dc372e79c9dfb9730de5b1a64a155236b1c66dae7f47e2bf2b4f91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6563 Malicious code in thrift-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da73b51938dc372e79c9dfb9730de5b1a64a155236b1c66dae7f47e2bf2b4f91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities in Apache Thrift

Summary IBM Security Guardium has fixed these vulnerabilities by updating the Apache Thrift component. Vulnerability Details CVEID:CVE-2016-5397 DESCRIPTION: Apache Thrift could allow a remote attacker to execute arbitrary commands on the system, caused by the use of an external formatting tool...

GHSA-W3R9-R9W7-8H48 Golang Facebook Thrift servers vulnerable to denial of service

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects...

Golang Facebook Thrift servers vulnerable to denial of service

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects...

GHSA-RJ7P-RFGP-852X Loop with Unreachable Exit Condition in Apache Thrift

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings...

Loop with Unreachable Exit Condition in Apache Thrift

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings...

GHSA-R4M4-PMVW-M6J5 Apache Thrift Go Library Command Injection

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0...

Apache Thrift Go Library Command Injection

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0...

GHSA-X4RG-4545-4W7W Improper Input Validation and Excessive Iteration in Go Facebook Thrift

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift...

Improper Input Validation and Excessive Iteration in Go Facebook Thrift

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift...

Mageia: Security Advisory (MGASA-2021-0578)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-202107-32 : Apache Thrift: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202107-32 Apache Thrift: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Apache Thrift. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifier...

Updated thrift/golang-github-apache-thrift packages fix security vulnerability

Malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service...