com.hazelcast:hazelcast-aws (2.4), com.hazelcast:hazelcast-build-utils (3.12-beta-1) +3 more potentially affected by CVE-2023-45860 via com.hazelcast:hazelcast (3.12-beta-1)

com.hazelcast:hazelcast MAVEN version 3.12-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-aws 2.4 - com.hazelcast:hazelcast-build-utils 3.12-beta-1 -...

com.hazelcast:hazelcast-build-utils (3.12-beta-2), com.hazelcast:hazelcast-client (3.12-beta-2) +1 more potentially affected by CVE-2023-45860 via com.hazelcast:hazelcast (3.12-beta-2)

com.hazelcast:hazelcast MAVEN version 3.12-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-build-utils 3.12-beta-2 - com.hazelcast:hazelcast-client 3.12-beta-2 -...

com.hazelcast:hazelcast-build-utils (3.10.7), com.hazelcast:hazelcast-client (3.10.7) +1 more potentially affected by CVE-2023-45860 via com.hazelcast:hazelcast (3.10.7)

com.hazelcast:hazelcast MAVEN version 3.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast:hazelcast-build-utils 3.10.7 - com.hazelcast:hazelcast-client 3.10.7 -...

CVE-2024-0023

In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : shadow vulnerability (USN-6640-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6640-1 advisory. It was discovered that shadow was not properly sanitizing memory when running the password utility. An...

co.paralleluniverse:comsat-test-utils (0.2.0), io.undertow:undertow-servlet (1.1.0.beta5) +2 more potentially affected by CVE-2024-1459 via io.undertow:undertow-core (1.1.0.beta5)

io.undertow:undertow-core MAVEN version 1.1.0.beta5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - co.paralleluniverse:comsat-test-utils 0.2.0 - io.undertow:undertow-servlet 1.1.0.beta5 -...

com.opensearchserver:oss-java-client (1.0.0), com.opensearchserver:oss-utils (1.0.0) +63 more potentially affected by CVE-2024-1459 via io.undertow:undertow-core (1.1.2.final)

io.undertow:undertow-core MAVEN version 1.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.opensearchserver:oss-java-client 1.0.0 - com.opensearchserver:oss-utils 1.0.0 -...

co.paralleluniverse:comsat-test-utils (0.4.0), com.gitblit.fathom:fathom-core (>=0.5.2, <=0.6.0) +92 more potentially affected by CVE-2024-1459 via io.undertow:undertow-core (1.2.8.final)

io.undertow:undertow-core MAVEN version 1.2.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - co.paralleluniverse:comsat-test-utils 0.4.0 - com.gitblit.fathom:fathom-core =0.5.2, =0.5.2, =0.5.2,...

maven-shared-utils: Command injection via Commandline class

A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack...

maven-shared-utils: Command injection via Commandline class

A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack...

maven-shared-utils: Command injection via Commandline class

A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack...

maven-shared-utils: Command injection via Commandline class

A flaw was found in the maven-shared-utils package. This issue allows a Command Injection due to improper escaping, allowing a shell injection attack...

Malware in iris-front-test-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-24189

Jsish v3.5.0 commit 42c694c was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c...

@hyperledger/cactus-plugin-htlc-coordinator-besu (2.0.0-alpha.2), @hyperledger/cactus-plugin-persistence-ethereum (>=2.0.0-2945-supply-chain-app-build-failed.241, <=2.0.0-main.214) +20 more potentially affected by CVE-2024-21505 via web3-utils (>=4.0.0-alpha.1, <=4.2.1-dev.f696e47.0)

web3-utils NPM version =4.0.0-alpha.1, =2.0.0-2945-supply-chain-app-build-failed.241, =2.0.0-2945-supply-chain-app-build-failed.241, =0.0.88, =0.0.84, =0.0.244-test-deposit-improve-v19, =4.0.2-dev.023f02d.0, =4.0.2-dev.023f02d.0, =4.0.2-dev.023f02d.0, =4.0.2-dev.023f02d.0, =4.0.2-dev.023f02d.0,...

oap-dash (>=0.0.1, <=0.0.2), opsramp-analytics-utils (>=1.0.0, <=3.4.7) +4 more potentially affected by CVE-2024-21485 via dash (1.16.2)

dash PYPI version 1.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on dash and may be impacted: - oap-dash =0.0.1, =1.0.0, =2.2.1, =2.4.6 - test1-opsramp-analytics-utils 2.2.6 - test2-opsramp-analytics-utils 1.1.0 Source cves: CVE-2024-21485 Source...

oap-dash (>=0.0.1, <=0.0.2), opsramp-analytics-utils (>=1.0.0, <=3.4.7) +4 more potentially affected by CVE-2024-21485 via dash (1.16.2)

dash PYPI version 1.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on dash and may be impacted: - oap-dash =0.0.1, =1.0.0, =2.2.1, =2.4.6 - test1-opsramp-analytics-utils 2.2.6 - test2-opsramp-analytics-utils 1.1.0 Source cves: CVE-2024-21485 Source...

CVE-2024-0959: Deserialization of Untrusted Data

A vulnerability was found in StanfordVL GibsonEnv 0.3.1. It has been classified as critical. Affected is the function cloudpickle.load of the file gibson\utils\pposgdfuse.py. The manipulation leads to deserialization. It is possible to launch the attack remotely. The complexity of an attack is...

RHEL 8 : shadow-utils (RHSA-2024:0417)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0417 advisory. The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user a...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2023-50943 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2023-50943 Source advisory:...