Malicious code in @hyperion-util/deferred-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ee6f14ca7114d9a5fd5096b74a8d6efa41d9df7e63dfcbfa2778ba8ba7d5dc64 The OpenSSF Package Analysis project identified '@hyperion-util/deferred-value' @ 77.77.79 npm as malicious. It is considered malicious because:...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : ZenLib vulnerability (USN-6048-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6048-1 advisory. It was discovered that ZenLib doesn't check the return value of a specific operation before using it. An attacker could use a specially...

Fedora: Security Advisory for redis (FEDORA-2023-04239b5758)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Why you should practice rollbacks to prevent data loss in a ransomware attack

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Tanya Janca, Founder...

[SECURITY] Fedora 36 Update: redis-6.2.12-1.fc36

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

[SECURITY] Fedora 38 Update: redis-7.0.11-1.fc38

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

[SECURITY] Fedora 37 Update: redis-7.0.11-1.fc37

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

GHSA-F737-3FH6-JF6W Prototype Pollution in vConsole

vConsole was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts...

UBUNTU-CVE-2022-25273

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

CVE-2023-30363

vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts...

CVE-2023-30363

vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts...

ToolJet 安全漏洞

ToolJet is an extensible low-code framework for building business applications from ToolJet. A security vulnerability exists in Tooljet version v1.6.0 that stems from not properly handling missing values in the API. An attacker can exploit the vulnerability to arbitrarily reset a password via a...

PT-2023-20033 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: The issue allows attackers to execute arbitrary code via a crafted Excel file, exploiting a CSV injection vulnerability. This vulnerability is present in the Last Name and First Name input fields when...

GHSA-W9G2-3W7P-72G9 Incorrect success value returned in vyper

Background During the audit of Lido's Gate Seals code statemind team identified a weird behavior of the code that uses rawcall: https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vyL164 . Construction like this: vyper success = rawcall...

Getting started with the CDMC framework—Microsoft’s guide to cloud data management

On March 20, 2023, Microsoft announced the successful completion of the Cloud Data Management Capabilities CDMC certification. As a proponent of wider industry standards, I was fortunate to be part of Microsoft’s executive team working to achieve this important milestone. Beginning in 2020, we...

CVE-2023-26557

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. bnb-chain/tss-lib and...

CVE-2023-26557

io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/paillier.go. bnb-chain/tss-lib and...

CVE-2023-21965

creationtimestamp| type| source ---|---|--- 2023-04-19 00:35:44+00:00| seen| https://t.me/cibsecurity/62420...

Burn logic issue due to lack of checking parameter 0 in burnWithReserve function

Lines of code Vulnerability details Impact The token quantity is sent to 0 and then the token is internally burned, causing a logic problem. Proof of Concept 1. burnWithReserve - reservePPM = 0 2. calculateFreedAmount call - The result is scaled by the ratio of currentReserve and minterReserve...

Signature malleability for S

Lines of code Vulnerability details Impact Ethereum contracts often assumes that the signature is unique, but signatures can be altered without the possession of the private key and still be valid. The EVM specification defines several so-called ‘precompiled’ contracts one of them being ecrecover...