CVE-2022-43304

Summary: CVE-2022-43304 describes a code-execution backdoor in the PyPI package d8s-timer for Python, introduced by a third party. The backdoor is associated with the democritus-uuids package, and the affected software/version cited is d8s-timer with version 0.1.0 (and related d8s-htm code path)....

CVE-2022-23949

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar...

CVE-2022-23949

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar...

CVE-2022-23949

In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar...

CVE-2022-23949

CVE-2022-23949 affects Keylime

Remote Code Execution (RCE)

d8s-uuids is vulnerable to remote code execution. The vulnerability exists because the library does not properly handle the package upload mechanism, allowing an attacker to inject and execute malicious packages...

CVE-2022-40806

The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

d8s-dates (=0.1.0), d8s-dicts (=0.1.0) +5 more potentially affected by unknown CVE via democritus-hypothesis (=2021.1.2101)

democritus-hypothesis PYPI version =2021.1.2101 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-hypothesis and may be impacted: - d8s-dates =0.1.0 - d8s-dicts =0.1.0 - d8s-domains =0.1.0 - d8s-ip-addresses =0.1.0 - d8s-strings =0.1.0 -...

d8s-strings (=0.1.0), d8s-timer (=0.1.0) potentially affected by unknown CVE via democritus-uuids (=2021.1.2101)

democritus-uuids PYPI version =2021.1.2101 is affected by a known vulnerability. The following packages have a transitive dependency on democritus-uuids and may be impacted: - d8s-strings =0.1.0 - d8s-timer =0.1.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-DEMOCRITUSUUIDS-8400829...

Malicious Package

Overview democritus-uuids is a malicious package. This package is used for dependency confusion attempts and contains malicious code. The package now exists as a placeholder on PyPI. Remediation Avoid using all malicious instances of the democritus-uuids package. References - GitHub Issue - GitHu...

PYSEC-2022-43103

The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

PYSEC-2022-43103

The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

CVE-2022-40806

The d8s-uuids for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

CVE-2022-40806

CVE-2022-40806 affects the Python package d8s-uuids from PyPI (version 0.1.0). The root cause is a backdoor inserted by a third party in the package, tracked across multiple feeds (e.g., Red Hat, NVD, OSV, Veracode). The vulnerability enables remote code execution with a high impact : attacker-co...

PT-2022-37366 · Pypi · Democritus-Hypothesis +1

Name of the Vulnerable Software and Affected Versions: d8s-uuids version 0.1.0 Description: The d8s-uuids package for Python, distributed on PyPI, contains a potential code-execution backdoor. This backdoor is attributed to the democritus-hypothesis package, which was inserted by a third party...

Democritus Project 安全漏洞

Democritus Project is a collection of simple, effective, modular, fully tested and well-documented features from Democritus, Inc. A security vulnerability exists in Democritus Project d8s-uuids version 0.1.0 that originates from a potential code execution backdoor inserted by a third party...

GO-2022-0244 Insufficient randomness in UUIDs in github.com/satori/go.uuid

Random data used to create UUIDs can contain zeros, resulting in predictable UUIDs and possible collisions...

GHSA-F4QX-JQFQ-7785 Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on...

Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on...

Virtuozzo Hybrid Server 7.5 Update 1 Hotfix 4 (7.5.1-739)

The Hotfix 4 for Virtuozzo Hybrid Server 7.5 Update 1 provides a stability and usability bug fix. Vulnerability id: PSBM-130698 Migrating a container from Virtuozzo 6 to Virtuozzo Hybrid Server 7 with the '--keep-src' option could result in duplicate UUIDs in 'prlctl list' output on the destinati...