Archive
29 January 2021
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
Critical —
Steam Socialite Provider v1 does not correctly validate openid server
### Impact The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server. ### Patches This vulnerability only affects the outdated v…
-
Critical 9.8
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web inte…
KEV Nov 3, 2021 -
Critical —
Malicious npm package: an0n-chat-lib
The npm `an0n-chat-lib` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comp…
-
Critical —
Malicious npm package: discord-fix
The npm `discord-fix` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comput…
-
Critical —
Malicious npm package: sonatype
The npm `sonatype` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer …
-
Critical 9.8
Read of uninitialized memory in cdr
An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.