MAL-2024-2495 Malicious code in hw-webpack-config (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3946 Malicious code in @realty-front/webpack-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3945 Malicious code in @expue/webpack (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @expue/webpack (npm)

--- -= Per source details. Do not edit below this line.=-...

Important: Red Hat Security Advisory: Migration Toolkit for Runtimes security, bug fix and enhancement update

Migration Toolkit for Runtimes 1.2.6 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

webpack-dev-middleware: lack of URL validation may lead to file leak

A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling...

Malicious code in core-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b8224957c90ee66ed3cc6af4e8b300d5eb082f8368f94b725e53bbfed9ccbf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1596 Malicious code in core-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b8224957c90ee66ed3cc6af4e8b300d5eb082f8368f94b725e53bbfed9ccbf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bootstrap-npm-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fd1dc66e2c97cb20814b56fc5ff776a96f0851f09647f1cef4cfb305ec2b3a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1573 Malicious code in bootstrap-npm-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fd1dc66e2c97cb20814b56fc5ff776a96f0851f09647f1cef4cfb305ec2b3a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of intermediate software for the Express Webpack-dev-middleware is related to insufficient checking of URL addresses, which allows unauthorized access to protected information.

The vulnerability of intermediate software for the Express Webpack-dev-middleware relates to insufficient validation of the URL address before returning the local file. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Important: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update

Migration Toolkit for Applications 7.0.3 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.11.4 security update

An update is now available for Red Hat OpenShift GitOps v1.11.4 for Argo CD UI and Console Plugin. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed these vulnerabilities with an update. Vulnerability Details CVEID:CVE-2023-41419 DESCRIPTION: Gevent could allow a remote attacker to gain...

Security Bulletin: The Log Source Management App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2024-28849, CVE-2024-29041, CVE-2024-29180)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. Log Source Management App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2024-28849 DESCRIPTION: Node.js...

Path Traversal

webpack-dev-middleware is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of URL addresses, allowing attackers to access any file on the developer's machine by manipulating the URL with specific encoded sequences such as %2e or %2f...

CVE-2024-29180

A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling...

GHSA-WR3J-PWJ9-HQQ6 Path traversal in webpack-dev-middleware

Summary The webpack-dev-middleware middleware does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. Details The middleware can either work with the physical filesystem when reading the files or it can...

@angular-architects/build-angular (=16.2.0-next.2), @angular-devkit/build-angular (>=15.1.0 <=17.3.1) +164 more potentially affected by CVE-2024-29180 via webpack-dev-middleware (>=6.0.0 <=6.1.1)

webpack-dev-middleware NPM version =6.0.0, =15.1.0, =9.3.0, =1.12.3, =4.20.4, =0.1.0, =3.1.0, =3.0.0-alpha.14, =15.1.0, =16.0.0-next.6, =2.6.0, =8.4.0, =7.0.0-rc.11, =7.0.0-rc.16 and more Source cves: CVE-2024-29180 Source advisory: OSV:GHSA-WR3J-PWJ9-HQQ6...

Path traversal in webpack-dev-middleware

Summary The webpack-dev-middleware middleware does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. Details The middleware can either work with the physical filesystem when reading the files or it can...