4356 matches found
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-38094link is external link is externalMicrosoft SharePoint Deserialization Vulnerability These types of vulnerabilities are frequent attack vectors for malicious...
编号撤回
Asterisk is an Asterisk open source software for PBX systems that runs on Linux and supports IP calls using SIP, IAX, and H323 protocols. This CVE number has been withdrawn...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-30088link is external Microsoft Windows Kernel TOCTOU Race Condition Vulnerability CVE-2024-9680link is external Mozilla Firefox Use-After-Free Vulnerability...
CVE-2024-9164
An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation of the vector-toc-toggle-button-label parameter. Remediation A fix was pushed into the master branch but not yet published. References - Gerrit Wikimedia - GitHub Commit - Wikimedia Phabricator...
Malicious code in branch-design-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce05613edf65a4a8af219c02f9ea8ec4563b9d66c2d4d824617dcc69d4bca211 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-9134 Malicious code in branch-design-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce05613edf65a4a8af219c02f9ea8ec4563b9d66c2d4d824617dcc69d4bca211 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in branch-extension (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1be4b8afeed9f4f3ece58c4cfde48b3909e1c22e69a8267c4e156326a79d7235 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-9135 Malicious code in branch-extension (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1be4b8afeed9f4f3ece58c4cfde48b3909e1c22e69a8267c4e156326a79d7235 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Gitlab -- vulnerabilities
Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Keys can push changes to an archived repository Guests can disclose project templates GitLab instanc...
CentOS 7 : kernel-alt (RHSA-2020:0174)
The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0174 advisory. - In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanoutadd from setsockopt and bind on an AFPACKET socket...
GHSA-62CX-5XJ4-WFM4 ggit is vulnerable to Command Injection via the fetchTags(branch) API
All versions of the package ggit are vulnerable to Command Injection via the fetchTagsbranch API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec Node.js child process API...
ggit 安全漏洞
ggit is a tool by Gleb Bahmutov Personal Developer. A security vulnerability exists in ggit that stems from allowing the user to enter the branch to be fetched, leaving it vulnerable to command injection attacks...
SUSE: Security Advisory (SUSE-SU-2024:3524-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2024-18946
Name of the Vulnerable Software and Affected Versions ggit versions all Description The issue concerns Command Injection via the fetchTagsbranch API, which allows user input to specify the branch to be fetched. This input is then concatenated with a git command and passed to the unsafe exec Node....
SUSE: Security Advisory (SUSE-SU-2024:3523-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Improper Access Control
Overview Affected versions of this package are vulnerable to Improper Access Control via the abusefiltercheckmatch API, due to missing checks of the permissions to see the log details for the given filter. This allows an attacker to bypass hidden and protected visibility settings. Remediation A f...
Mars: █████████ when adding branches to your account
A vulnerability was identified in the branch addition functionality of the Royal Canin specialized channel website. The issue was classified as an Insecure Direct Object Reference IDOR vulnerability, which allowed unauthorized users to add branches to any account by manipulating the customer's...
Malicious Package
Overview branch-extension is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection between that...
Malicious Package
Overview branch-extension is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection between that...