Snyk Security Database

etoro-auth is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors.

snowflake-connector-python is a Snowflake Connector for Python

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can obtain authentication tokens, encryption keys, pre-signed URLs, and SAML assertions by accessing diagnostic logs that were insufficiently redacted. This is only exploitable if the attacker has read access to the log destination, such as the local filesystem, a log aggregation service, or a CI/CD artifact store.

org.graalvm.sdk:graal-sdk is a high-performance JDK distribution designed to accelerate the execution of applications written in Java and other JVM languages along with support for JavaScript, Ruby, Python, and a number of other popular languages.

Affected versions of this package are vulnerable to Improper Certificate Validation in its TLS handshake handling of the no_certificate warning alert, which was honored regardless of the negotiated protocol version and silently removed the CERTIFICATE and CERTIFICATE_VERIFY handshake consumers when the server had client authentication requested. An attacker connecting as the TLS client can make the server drop its expectation of a client certificate and CertificateVerify by sending a no_certificate alert during a TLSv1.x handshake, even though that alert is defined only for SSLv3. This affects a JSSE server operating with client authentication requested rather than required, and the flaw carries high attack complexity.