Search: com.ar

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cccb2aed2f968e146b433d2a2600f17104f0dcacfd951190771f8e59aee3a252) tailwind-form-kit@0.6.4 impersonates @tailwindcss/forms (package.json sets repository to https://github.com/tailwindlabs/tailwindcss-forms) but src/index.js is a heavily obfuscated single-line loader (obfuscator.io string-array shape, all identifiers _0xNNNN). On require() — as would happen when the package is referenced from tailwind.config — the loader opens HTTP/HTTPS to Ethereum public RPCs (publicnode, drpc.org/eth, blockscout) and an Etherscan-like indexer at *stapi.io, queries a hardcoded sender address 0xa322E5f39aDC2490EfD311D3080e6f0121063e1a via eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, extracts a base64/gzip/deflate/br-encoded payload from an x-payload-B64 header or transaction data, and invokes child_process.spawn('node',...) on the retrieved bytes. This is the EtherHiding fetch-and-exec pattern: the on-chain address acts as a mutable C2 pointer, and any developer or build machine that requires this package runs whatever code the attacker currently points it at. A CSS forms plugin has no legitimate reason to talk to Ethereum RPCs or spawn node on fetched bytes.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf) Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package (reusing its description, repository URL github.com/srounet/Pymem, and author identity Fabien Reboia <srounet@gmail.com>) republished under a confusable name. The top-level pymem/__init__.py contains a one-line loader that reverses a bytes literal, base64-decodes it, zlib-decompresses it, and passes the result to exec(). This runs unconditionally on `import pymem`, handing full in-process code execution to a payload deliberately hidden behind three stacked transforms. The multi-layer obfuscation around an exec target has no legitimate purpose in a library import path; combined with the typosquat cover story that reuses the upstream author's identity, the package's function on install/import is to run attacker-chosen code inside any process that imports it. ## Source: kam193 (82eb1f11c9b56a2f2c3e97530db43ef94784a2c75697223828403927b0528477) During import, the obfuscated code downloads and executes an executable. The remote executable did not exist during analysis, but the repository used to host it overlaps with previous campaign 2026-07-yt-api-dlp --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-pymem-win Reasons (based on the campaign): - obfuscation - Downloads and executes a remote executable. - clones-real-package

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter.

A security bypass vulnerability was discovered in `@angular/common` when Server-Side Rendering (SSR) and hydration are enabled in applications using a hierarchical `HttpClient` configuration with `withRequestsMadeViaParent()`. The `HttpTransferCache` utility optimizes hydration by caching outgoing HTTP requests performed during SSR and transferring the cached state to the client-side application via `TransferState` (serialized as JSON in `<script id="ng-state">`). Following the remediation of [CVE-2026-50170](https://github.com/angular/angular/security/advisories/GHSA-q6f4-qqrg-jv6x), `HttpTransferCache` automatically skips caching requests that contain authentication headers or credentials (`Authorization`, `Cookie`, `withCredentials`, etc.). However, when a child `HttpClient` delegates to a parent client via `withRequestsMadeViaParent()`, the child's `TransferCache` interceptor evaluates whether the request is eligible for caching **before** delegating to the parent client's interceptor chain. If an outgoing request originates as anonymous from the child client, the child `TransferCache` marks the request as cacheable. When the request reaches a parent interceptor that injects sensitive authentication credentials (such as an `Authorization` header or API token), the parent `TransferCache` correctly skips caching the authenticated request. However, when the backend returns the private, authenticated response, the child `TransferCache` still stores the response in `TransferState` based on its initial pre-delegation evaluation. ### Impact Successful exploitation allows sensitive, user-specific information belonging to an authenticated user to be leaked to unauthenticated or unauthorized users. This occurs when: 1. During SSR, a child `HttpClient` initiates an unauthenticated request that is subsequently authenticated by a parent interceptor. 2. The authenticated response body is cached into the SSR-rendered HTML page (`TransferState`). 3. The rendered HTML page is stored by a shared caching layer (e.g., CDN, edge cache, or reverse proxy) or served across user sessions. 4. Subsequent visitors requesting the same page receive the cached HTML containing the previous user's private data. ### Attack Preconditions & Vulnerable Configurations An application is affected only if **all** of the following conditions are met: * **SSR and Hydration Enabled:** The application uses Server-Side Rendering with hydration enabled (e.g., via `provideClientHydration()`). * **Hierarchical `HttpClient` with Delegation:** The application configures a child `HttpClient` using `withRequestsMadeViaParent()`. * **Parent-Level Authentication Injection:** Authentication credentials (such as `Authorization` headers, session cookies, or custom API tokens filtered via `withHttpTransferCacheOptions`) are attached by an interceptor in the **parent** injector chain rather than on the initial child request. * **Shared HTML Caching:** The SSR HTML responses are cached by a shared caching layer (CDN, reverse proxy, or application-level HTML cache). #### Vulnerable Code Pattern Example ```ts // Parent Injector / Application Config export const appConfig: ApplicationConfig = { providers: [ provideHttpClient( // Parent interceptor attaches sensitive Authorization header withInterceptors([ (req, next) => next(req.clone({ setHeaders: { Authorization: `Bearer ${getToken()}` } })) ]) ), ], }; // Child Injector / Feature or Component Config const childClient = createEnvironmentInjector( [ // Child delegates to parent; TransferCache evaluates req BEFORE parent auth interceptor runs provideHttpClient(withRequestsMadeViaParent()), ], parentInjector ).get(HttpClient); // Request originates without auth headers -> marked cacheable by child TransferCache childClient.get('/api/user/profile').subscribe(); ``` ### Patches The issue is resolved by updating `@angular/common` to run root interceptors in the terminal request chain so that delegated clients leave inherited root interceptors to the parent chain, preventing duplicate execution and ensuring `HttpTransferCache` evaluates cache eligibility after parent request interceptors run. * `22.1.1` * `21.2.20` * `20.3.28` ### Workarounds & Mitigations For applications that cannot immediately upgrade to a patched version, use one of the following mitigations: 1. **Attach Credentials Before or Within the Child Client:** Ensure authentication headers (e.g., `Authorization`) are attached directly when constructing the request or via an interceptor configured directly on the child `HttpClient`, rather than relying solely on parent interceptors. 2. **Apply Explicit Cache Filters on the Child Client:** Configure `withHttpTransferCacheOptions` with a filter on the child client that explicitly excludes endpoints returning user-specific or sensitive data: ```ts provideClientHydration( withHttpTransferCacheOptions({ filter: (req) => !req.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30) The package presents itself as a Tailwind CSS forms plugin (README, repository field, and installation docs are copied verbatim from @tailwindcss/forms) but its sole main module src/index.js is a heavily obfuscator.io-obfuscated Node loader with no CSS-plugin functionality. On require(), the module executes top-level code that installs a createRequire and publishes require, module, and global into named globals (global.r, global.m, global.i, plus several _H/_t_u/_t_s handles) and imports spawn from node:child_process — a stager shape that hands arbitrary execution primitives to code assembled from the rotating string array. It also enumerates public Ethereum JSON-RPC endpoints (drpc.org, publicnode.com, blockscout, blastapi.io) and an Etherscan-like indexer, calls eth_blockNumber / eth_getBlockByNumber / eth_getTransactionCount, and pulls the transaction list for a hardcoded 42-character Ethereum address 0xa322E5f39aDC2490Ef6f0121063eD311D3080e1a, using the returned data as C2 signalling. Results are POSTed with a custom X-Payload-* header to an external endpoint reconstructed from string-array fragments ending in ut.com/api. A CSS plugin has no legitimate reason for obfuscation, node:child_process, or Ethereum RPC traffic; the cover story does not match the shipped code, and the payload runs the moment a developer requires the package.

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromised GitHub server can return a `Link` header pointing to an attacker-controlled host and cause Renovate to disclose those credentials to it. Exploitation requires that the GitHub server Renovate talks to (as the repository host or as a datasource such as github-releases, github-tags, or git-refs) is already malicious or compromised. The issue is fixed in renovate 44.11.3 (npm and renovate/renovate container images), Mend Renovate CE/EE images and the mend-renovate-ce helm chart 15.4.0, and the mend-renovate-enterprise-edition helm chart 10.4.0. There is no workaround; the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check and should only be used with servers that intentionally use different pagination hosts.

CVE-2026-78302 is a high-severity stored cross-site scripting (XSS) vulnerability in the SP Property extension for Joomla by joomshaper.com. Versions 1.0.0 through 4.1.3 are affected. The flaw arises from unescaped output in multiple template files across frontend views and administrator list tables, allowing unauthenticated attackers to inject malicious scripts. This vulnerability can lead to significant impacts due to high attack vector and complexity ratings.

CVE-2026-78374 is a medium severity vulnerability in the T4 Page Builder extension for Joomla by joomlart.com. Versions 1.0.0 through 2.2.0 are affected. The vulnerability allows unauthenticated attackers to send emails via an open mail relay through the front-end JSON editor's contact AJAX endpoint. This endpoint lacks authentication, CSRF protection, captcha enforcement (if no captcha plugin is enabled), and rate limiting. Attackers can fully control the recipient, subject, and HTML body of the email, which is sent from the site's configured sender identity.

CVE-2026-78084 is a medium severity vulnerability in the SP Property extension for Joomla by joomshaper.com. Versions 1.0.0 through 4.1.3 are affected. The issue involves missing access control and lack of CSRF token validation in the gallery image management controller, allowing unauthorized users to perform file removal with arbitrary paths or upload unverified file types.

Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data. ## Impact - `Cstruct.filter_map` writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - `Cstruct.tail ~rev:true` removes two bytes instead of one and raises an exception for single-byte views. - `Cstruct.cuts ~rev:true` may compare input against the wrong data, split at incorrect positions, and construct results using offsets outside the requested view. - `Cstruct.find` and `Cstruct.find_sub ~rev:true` may return slices from the wrong location when operating on non-zero-offset views. These are a set of logical indexing and bounds-calculation errors (CWE-682), and not direct memory-safety vulnerabilities. However, affected operations may return corrupted data, raise an unexpected exception, split input incorrectly, or return bytes outside the requested Cstruct view but still within its backing buffer. In security-sensitive parsers, this could cause validation bypasses, denial of service, or unintended disclosure of adjacent buffer contents. ## Workarounds Users unable to upgrade cstruct should backport the corresponding source changes. There is no configuration-based mitigation since these are buggy library calls. ## References Discovered via [Scrutineer](https://github.com/alpha-omega-security/scrutineer) and Deepseek GLM-5.3 Flash running locally. ## Timeline - 2026-09-04: reported via GitHub to ocaml/security-advisories repository - 2026-09-05: reported via email to security@ocaml.org - 2026-09-05: patch proposed and reviewed - 2026-09-05: release cstruct 6.3.0 - 2026-09-10: published advisory

An unauthenticated SQL injection vulnerability exists in the SP Property extension for Joomla versions 1.0.0 through 4.1.3. The vulnerability arises from unsafe concatenation of user-supplied parameters into SQL queries in the property search and map filtering features, allowing attackers to perform blind SQL injection attacks to extract sensitive database information.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.70. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:62548 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ Security Fix(es): * unbound: Unbound Cache poisoning (CVE-2025-5994) * sqlite: Integer Truncation in SQLite (CVE-2025-6965) * podman: Podman kube play command may overwrite host files (CVE-2025-9566) * libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794) * libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796) * kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518) * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama is impacted by this vulnerability.

Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an efficient way to operate single-node clusters in these low-resource environments. This advisory contains the RPM packages for Red Hat build of MicroShift 4.19.46. Read the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:63047 Security Fix(es): * net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (CVE-2026-33814) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) All Red Hat build of MicroShift 4.19 users are advised to use these updated packages and images when they are available in the RPM repository.

CVE-2026-69294 is a vulnerability in Microsoft Windows 10 Version 1809 and related builds where error messages generated by Microsoft COM contain sensitive information. This flaw allows an authorized local attacker to disclose sensitive information through error messages. The vulnerability has a medium severity with a CVSS score of 5.5. Official patches are available from Microsoft to address this issue.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.13. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:63091 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ Security Fix(es): * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.