Oracle Linux 8 : cups-filters (ELSA-2024-7463)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-7463 advisory. - CVE-2024-47175 cups-filters: remote command injection via attacker controlled data in PPD file - CVE-2024-47076 cups-filters: cfGetPrinterAttributes...

Improper Source Verification

cups-filter is vulnerable to Improper Source Verification. cups-browsed binds to INADDRANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL. Due to the service binding to :631 INADDRANY , multiple bugs in...

DEBIAN-CVE-2024-47076

CUPS is a standards-based, open-source printing system, and libcupsfilters contains the code of the filters of the former cups-filters package as library functions to be used for the data format conversion tasks needed in Printer Applications. The cfGetPrinterAttributes5 function in libcupsfilter...

CVE-2024-45989

Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's sensitive chat data of the current session to a malicious...

CVE-2024-45989

Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's sensitive chat data of the current session to a malicious...

Cross Site Scripting(XSS)

@rspack/core is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to a DOM Clobbering gadget in the AutoPublicPathRuntimeModule, which allows unsanitized attacker-controlled HTML elements to lead to XSS attacks...

BIT-GITLAB-2024-6446 Business Logic Errors in GitLab

An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application...

UBUNTU-CVE-2024-6446

An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application...

CVE-2024-6446 Business Logic Errors in GitLab

An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application...

CVE-2024-6446 Business Logic Errors in GitLab

An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application...

NewStart CGSL MAIN 6.02 : openssh Vulnerability (NS-SA-2024-0061)

The remote NewStart CGSL host, running version MAIN 6.02, has openssh packages installed that are affected by a vulnerability: - A vulnerability was found in OpenSSH. The PKCS11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if ...

GHSA-Q765-WM9J-66QJ @blakeembrey/template vulnerable to code injection when attacker controls template input

Impact It is possible to inject and run code within the template if the attacker has access to write the template name. js const template = require'@blakeembrey/template'; template"Hello name!", "exploit && = console.log'success'; && function pwned"; Patches Upgrade to 1.2.0. Workarounds Don't pa...

Cross Site Scripting(XSS)

Webpack is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to improper handling and lack of sanitization of HTML elements and their attributes in Webpack's AutoPublicPathRuntimeModule, allowing attacker-controlled elements to execute malicious scripts...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

CVE-2024-42914

ArrowCMS 1.0.0 is affected by a host header injection in the forgot password feature. A crafted Host header can cause password reset links to be sent to an attacker-controlled server, leaking the reset token and potentially allowing the attacker to reset other users’ passwords. The connected sour...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

CVE-2024-42914

A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server a...

Hundreds of online stores hacked in new campaign

Whenever you shop online and enter your payment details, you could be at risk of being a victim of fraud. Digital skimmers are snippets of code that have been injected into online stores and they can steal your credit card number, expiration date and CVV/CVC as you type it in. We recently detecte...

CVE-2024-6707

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability...

CVE-2024-6707

Open WebUI suffers a path traversal and arbitrarily uploaded file vulnerability in version 0.1.105. The flaw arises when uploading files through the HTTP interface (via the + sign in the message input) to a static UPLOAD_DIR; the filename is taken from the request without validation, enabling tra...