amino-deploy (>=0.0.1, <=0.1.1), amino-drone (>=0.0.1, <=0.1.2) +65 more potentially affected by CVE-2013-4116 via npm (>=1.1.70, <=1.3.1)

npm NPM version =1.1.70, =0.0.1, =0.0.1, =0.3.4, =0.0.0, =0.12.3, =6.5.1-dev, =0.0.2, =1.0.30, =0.0.0, =0.0.1, =0.0.1, =0.2.0, =0.2.6 and more Source cves: CVE-2013-4116 Source advisory: OSV:GHSA-V3JV-WRF4-5845...

docpad-plugin-posteditor (>=2.0.0, <=2.1.2) potentially affected by CVE-2014-8881 via bleach (0.3.0)

bleach NPM version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on bleach and may be impacted: - docpad-plugin-posteditor =2.0.0, =2.1.2 Source cves: CVE-2014-8881 Source advisory: OSV:GHSA-MVMF-CVFX-QG55...

passport-ldapauth (0.0.3) potentially affected by CVE-2015-7294 via ldapauth (2.0.0)

ldapauth NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ldapauth and may be impacted: - passport-ldapauth 0.0.3 Source cves: CVE-2015-7294 Source advisory: OSV:GHSA-82MG-X548-GQ3J...

GHSA-W4PJ-7P68-3VGV Stored XSS in October

Impact A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. Patches Issue has been patched in Build 466 v1.0.466 & RainLab.Blog v1.4.1 by restricting the...

@arve.knudsen/bankai (>=9.6.0, <=9.10.14), @citation-js/browserify-disc (1.3.4) +63 more potentially affected by CVE-2020-36632 via flat (>=1.0.0, <=1.6.0)

flat NPM version =1.0.0, =9.6.0, =2.6.0, =1.0.0, =1.0.0-1, =0.0.1, =0.0.1, =0.0.10, =1.0.0, =7.3.0, =9.10.4, =0.0.1, =0.0.3, =0.0.4 and more Source cves: CVE-2020-36632 Source advisory: SNYK:JS-FLAT-596927...

USN-4437-1 libslirp vulnerability

Ziming Zhang and VictorV discovered that libslirp incorrectly handled replying to certain ICMP echo requests. A remote attacker could possibly use this issue to cause libslirp to crash, resulting in a denial of service...

Server Side Request Forgery Vulnerability in Hitachi Ops Center Analyzer viewpoint

Overview A Server Side Request Forgery Vulnerability was found in Hitachi Ops Center Analyzer viewpoint. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take...

@3deye-toolkit/react-camera (>=0.0.1-alpha.7, <=0.0.1-alpha.11), @3deye-toolkit/react-event-list (>=0.0.1-alpha.7, <=0.0.1-alpha.12) +100 more potentially affected by unknown CVE via i18next (>=19.0.0, <=19.8.2)

i18next NPM version =19.0.0, =0.0.1-alpha.7, =0.0.1-alpha.7, =1.0.0, =0.2.0-alpha.1, =2.0.0, =2.0.0, =0.0.0, =1.34.1, =0.0.10, =1.15.0-alpha1, =1.0.1-alpha.9762.0, =0.2.2-alpha.3546.0, =0.3.2, =0.4.4, =0.5.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-I18NEXT-585930...

@amazingcat/amazing-iohook (>=7.1.4, <=8.1.1), @barajs/electron (>=1.0.0, <=1.0.2) +30 more potentially affected by CVE-2020-4075 via electron (>=7.0.0, <=7.2.3)

electron NPM version =7.0.0, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0-alpha.3, =4.0.0-alpha.1, =0.0.1, =7.0.0-alpha.7, =1.7.0, =7.0.0-beta.1, =8.0.0-pre, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-4075 Source advisory: OSV:GHSA-F9MQ-JPH6-9MHM...

@amazingcat/amazing-iohook (8.2.3), @donmahallem/trapeze-client-desktop (5.1.1) +14 more potentially affected by CVE-2020-4077 via electron (>=8.0.0, <=8.2.3)

electron NPM version =8.0.0, =8.0.0-beta.1, =0.1.0, =4.0.0-beta.1, =1.0.1, =1.7.0, =1.0.3, =1.0.5, =1.1.35, =3.1.20, =3.2.1 and more Source cves: CVE-2020-4077 Source advisory: OSV:GHSA-H9JC-284H-533G...

@10yun/cv-mobile-ui (0.3.20), @accordproject/cicero-cli (>=0.3.4, <=0.8.0) +496 more potentially affected by CVE-2020-14966 via jsrsasign (>=4.8.2, <=8.0.18)

jsrsasign NPM version =4.8.2, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.0.61-20180603194157, =0.14.7, =2.0.1-alpha.0, =1.0.0-beta.0, =1.0.0-beta.0, =2.0.1-alpha.0, =1.0.0-beta.0, =1.2.1-alpha.0 and more Source cves: CVE-2020-14966 Source advisory:...

@aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3), @aerogear/apollo-voyager-server (>=0.1.0, <=0.2.7-rc3) +132 more potentially affected by unknown CVE via apollo-server-core (>=2.0.0, <=2.12.0)

apollo-server-core NPM version =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =0.5.1-alpha.0, =2.11.0, =3.9.0, =2.2.0-alpha.1, =2.3.10, =1.0.0, =2.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

codelift (>=0.6.3-canary.85.acbf24c.0, <=1.0.15-canary.394.652cc97.0), ra-gen-ui-lib (>=1.0.0-rc.3, <=1.0.0-rc.5) potentially affected by unknown CVE via apollo-server-micro (>=2.9.16, <=2.14.1)

apollo-server-micro NPM version =2.9.16, =0.6.3-canary.85.acbf24c.0, =1.0.0-rc.3, =1.0.0-rc.5 Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...

app-policy-auth (4.5.0) potentially affected by CVE-2020-7674 via access-policy (3.1.0)

access-policy NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on access-policy and may be impacted: - app-policy-auth 4.5.0 Source cves: CVE-2020-7674 Source advisory: SNYK:JS-ACCESSPOLICY-571490...

@neuraflash/einstein-lang (1.0.0), @safwanuk/sk-npm-hello-world (>=6.0.1, <=6.0.2) +63 more potentially affected by CVE-2020-7646 via curlrequest (>=0.3.10, <=1.0.1)

curlrequest NPM version =0.3.10, =6.0.1, =1.0.2, =0.2.0, =0.0.1, =0.1.0, =0.6.0, =0.0.1, =1.0.0, =0.3.0-a, =1.0.25, =0.1.0, =0.5.0 and more Source cves: CVE-2020-7646 Source advisory: SNYK:JS-CURLREQUEST-568274...

Fedora: Security Advisory for podman (FEDORA-2020-ccc3e64ea5)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Vulnerability Spotlight: Remote code execution vulnerability in Apple Safari

Marcin Towalski of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. The Apple Safari web browser contains a remote code execution vulnerability in its Fonts feature. If a user were to open a malicious web page in Safari, they could trigger a type confusion, resulting in memory...

Fedora 30 : 1:java-11-openjdk (2020-d735a887d1)

Update to the January 2020 CPU release 11.0.6. See: http://mail.openjdk.java.net/pipermail/jdk-updates-dev/2020-January/00 2374.html https://openjdk.java.net/groups/vulnerability/advisories/2020-01-14 Note that Tenable Network Security has extracted the preceding description block directly from t...

Vulnerability Spotlight: Denial-of-service, information leak bugs in Mini-SNMPD

Aleksandar Nikolic of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Multiple vulnerabilities exist in Mini-SNMPD, a lightweight implementation of a Simple Network Management Protocol server. An attacker can exploit these bugs by providing a specially crafted SNMPD request to...

Vulnerability Spotlight: Bitdefender BOX 2 bootstrap remote code execution vulnerabilities

Claudio Bozzato, Lilith Wyatt and Dave McDaniel of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. The Bitdefender BOX 2 contains two remote code execution vulnerabilities in its bootstrap stage. The BOX 2 is a device that protects users’ home networks from a variety of threats...