Malicious code in cosmosdb-server (npm)

Source: amazon-inspector 925077d4c86616920b1ad20f2342df7473d9504764582235049e78eed9189a76 Package squats the unscoped name cosmosdb-server, targeting users who mistype npx cosmosdb-server instead of the scoped @vercel/cosmosdb-server. The package.json declares bin: "cosmosdb-server": "./index.js"...

CVE-2019-25673

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 expose an arbitrary file upload vulnerability at the upload endpoint. An authenticated attacker can submit multipart form data to upload PHP files via the type parameter set to Files, then access the uploaded file in the working directory path ...

runc: file descriptor leak

A file descriptor leak issue was found in the runc package. While a user performs OCLOEXEC all file descriptors before executing the container code, the file descriptor is open when performing setcwd2, which means that the reference can be kept alive in the container by configuring the working...

Rocky Linux 8 : qt5 (RLSA-2022:7482)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7482 advisory. - In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not...