kpc-nifi-utils (0.2.3) potentially affected by CVE-2024-49750 via snowflake-connector-python (2.0.0)

snowflake-connector-python PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - kpc-nifi-utils 0.2.3 Source cves: CVE-2024-49750 Source advisory: OSV:PYSEC-2024-191...

CVE-2024-50382

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V...

CVE-2024-50383: Observable Discrepancy

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...

CVE-2024-50383

Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 used in Chacha-Poly1305 and x25519. An addition can be skipped if a carry is not set. This was observed for GCC 11.3.0 with -O2 on MIPS, and GCC on x86-i38...

CVE-2024-50382: Observable Discrepancy

Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LLVM 15 on RISC-V...

cn.jairdavis:jair-common-utils (1.0.4), com.allenru:cross-origin (1.0.1) +72 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (4.0.2.release)

org.springframework:spring-web MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.allenru:cross-origin 1.0.1 -...

Malicious code in utils.logger (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9900 Malicious code in utils-define-nonenumerable-read-only-property (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9476 Malicious code in @taxify/taxify-code-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

opengamedata-api-utils (>=1.1.0, <=1.1.1), opengamedata-common (>=0.0.1, <=1.2.2) +2 more potentially affected by CVE-2024-21272 via mysql-connector-python (8.0.25)

mysql-connector-python PYPI version 8.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on mysql-connector-python and may be impacted: - opengamedata-api-utils =1.1.0, =0.0.1, =1.0.0.dev782, =1.0.0.dev782, =7.1.2 Source cves: CVE-2024-21272 Source...

autoreduce-db (>=0.1.0, <=22.0.0.dev1), autoreduce-frontend (>=21.1.1, <=21.1.3) +4 more potentially affected by CVE-2024-45231 via django (3.2.2)

django PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =21.1.2, =21.1.4 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

boorunaut (0.4.2), shipmnts-utils (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2024-45231 via django (2.1.4)

django PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - boorunaut 0.4.2 - shipmnts-utils =0.0.1, =0.0.4 - upload-manager 1.3.0 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

UBUNTU-CVE-2024-25885

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service ReDOS via supplying a crafted string...

com.openshift.jenkins:openshift-pipeline (>=1.0.14, <=1.0.57), org.jenkins-ci.infra:pipeline-metadata-utils (>=1.0, <=1.2) +6 more potentially affected by CVE-2024-47804 via org.jenkins-ci.main:jenkins-core (1.651)

org.jenkins-ci.main:jenkins-core MAVEN version 1.651 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.openshift.jenkins:openshift-pipeline =1.0.14, =1.0, =0.10, =2.0.1, =1.58, =1.63 -...

CVE-2024-47611

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-47611

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-47611

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-47611 XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-47611 XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-47611 XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...