3346 matches found
anymodality (=0.1.0), autogluon-cloud (>=0.1.1b20230324 <=0.2.1b20230929) +19 more potentially affected by CVE-2024-34073 via sagemaker (>=1.52.1 <=2.207.1)
sagemaker PYPI version =1.52.1, =0.1.1b20230324, =0.9.0, =0.2.8, =1.97.0.dev0, =1.0.0, =1.0.0, =0.7.3, =0.1.2, =0.0.9, =0.1.6, =0.2.0, =0.5.1 and more Source cves: CVE-2024-34073 Source advisory: OSV:GHSA-7PC3-PR3Q-58VG...
shadow-utils: possible password leak during passwd(1) change
A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from...
Moderate: Red Hat Security Advisory: pcs security update
An update for pcs is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
ThievingFox - Remotely Retrieving Credentials From Password Managers And Windows Utilities
ThievingFox is a collection of post-exploitation tools to gather credentials from various password managers and windows utilities. Each module leverages a specific method of injecting into the target process, and then hooks internals functions to gather crendentials. The accompanying blog post ca...
Moderate: exfatprogs security update
The exfatprogs package contains utilities for formatting and repairing exFAT filesystems. Security Fixes: exfatprogs: exfatprogs allows out-of-bounds memory access CVE-2023-45897 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...
Moderate: Red Hat Security Advisory: pcs security update
An update for pcs is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impa...
@audius/sdk (=0.0.36), @cardinal/squads-utils (>=0.0.2 <=0.0.6) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (=1.53.0)
@solana/web3.js NPM version =1.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @audius/sdk =0.0.36 - @cardinal/squads-utils =0.0.2, =0.0.6 - @snowflake-so/wallet-adapter-snowflake =1.0.12 Source cves:...
@debridge-finance/solana-contracts-client (>=0.1.0 <=1.0.0), @debridge-finance/solana-utils (=1.0.2) potentially affected by CVE-2024-30253 via @solana/web3.js (=1.62.0)
@solana/web3.js NPM version =1.62.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @debridge-finance/solana-contracts-client =0.1.0, =1.0.0 - @debridge-finance/solana-utils =1.0.2 Source cves: CVE-2024-30253 Sour...
Hackers Linked to Russia’s Military Claim Credit for Sabotaging US Water Utilities
Cyber Army of Russia Reborn, a group with ties to the Kremlin’s Sandworm unit, is crossing lines even that notorious cyberwarfare unit wouldn’t dare to...
Malicious code in wt-fe-buz-utilities-collection (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da59ce3066bc4f743fd62c3c5db000f13a21c5167bf5987991697d4b631b6288 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-1266 Malicious code in wt-fe-buz-utilities-collection (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da59ce3066bc4f743fd62c3c5db000f13a21c5167bf5987991697d4b631b6288 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2024-19662
Name of the Vulnerable Software and Affected Versions Time4J Base version 5.9.3 Description A NullPointerException was discovered in Time4J Base via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodelLocale. However, the existence of this issue is disputed by multiple third...
ROS-20240409-17
Vulnerability of linebytessplit function src/split.c of GNU Core Utilities GNU Coreutils is related to a buffer overflow in dynamic memory. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
util-linux bug fix update
An update is available for util-linux. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The util-linux packages contain a large variety of low-level system...
Exploit for Embedded Malicious Code in Tukaani Xz
CVE-2024-3094 Checker The CVE-2024-3094 Checker is a powerful...
HashiCorp Response to XZ Utils Supply Chain Attack (CVE-2024-3094)
Summary HashiCorp products and services have no known exposure to the XZ Utils xz/liblzma supply chain attack and associated vulnerability, CVE-2024-3094, at this time. This bulletin will be updated if this situation changes. Background A supply chain attack that introduced malicious code into th...
Vulnerability fixed in liblzma (XZ Utils)
Malicious code has been found in liblzma XZ Utils software. XZ Utils is used for compression of data and may be present in Linux distributions. The vulnerability has been labeled CVE-2024-3094 and has been found in versions 5.6.0 and 5.6.1 of XZ Utils. A malicious party can exploit the...
@hyperledger/cactus-plugin-htlc-coordinator-besu (=2.0.0-alpha.2), @hyperledger/cactus-plugin-persistence-ethereum (>=2.0.0-2945-supply-chain-app-build-failed.241 <=2.0.0-main.214) +19 more potentially affected by CVE-2024-21505 via web3-utils (>=4.0.2-dev.a2a232f.0 <=4.2.1-dev.9d65c38.0)
web3-utils NPM version =4.0.2-dev.a2a232f.0, =2.0.0-2945-supply-chain-app-build-failed.241, =2.0.0-2945-supply-chain-app-build-failed.241, =0.0.88, =0.0.84, =0.0.244-test-deposit-improve-v19, =4.0.2-dev.3f49e18.0, =4.0.2-dev.3f49e18.0, =4.0.2-dev.3f49e18.0, =4.0.2-dev.3f49e18.0,...
CVE-2024-25392
RT-Thread CVE-2024-25392: An out-of-bounds access exists in utilities/var_export/var_export.c up to version 5.0.2. The issue affects RT-Thread before a fixed release; exact patched version is not specified in the provided documents. Impact details in the sources indicate a local exploit surface w...
