MAL-2024-6243 Malicious code in xolosxelwsesnp (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4356 Malicious code in Bloсkсore.Features.MemoryPool (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4312 Malicious code in Blazor.Captcha (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4123 Malicious code in Be.Vlaandereո.Basisregisters.Testing.Infrastructure.Evеnts (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3288 Malicious code in updated-tricks-roblox-robux-generator-2023-de-asw3er2 (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3217 Malicious code in tricks_updated_xbox_unlimited_giftcards__generator_for_free-wsavv (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2579 Malicious code in kendo-react-messages (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1812 Malicious code in barrio_sass (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @mosfe/sso-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-23153

A maliciously crafted MODEL file, when parsed in libodx.dll through Autodesk applications, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

U.S. Dept Of Defense: XML External Entity (XXE) Injection

The vulnerability is an XML external entity XXE injection flaw. XXE vulnerabilities occur when an application parses XML input that contains a reference to an external entity. When the XML parser is improperly configured to process external entities, it can lead to unauthorized access to sensitiv...

Hacker Claims TEG Ticket Vendor Breach: 30M User Records for Sale

Hacker "Sp1d3r" claims breaching TEG, an Australian ticketing giant, exposing 30 million users' data for sale on Breach Forums for USD 30,000...

LockBit Ransomware Claims 33 TB of US Federal Reserve Data for Ransom

LockBit ransomware claims to hold 33 TB of data from the US Federal Reserve for ransom. Hackread.com investigates, reaching out to CISA for comments on the breach and ongoing negotiations. Stay updated!...

kyosai-web.smrj.go.jp Cross Site Scripting vulnerability OBB-3938231

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-79H8-GXHQ-Q3JG Remote Code Execution in create_conda_env function in lollms

A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and pythonversion...

Remote Code Execution in create_conda_env function in lollms

A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and pythonversion...

CVE-2024-3121 Remote Code Execution in create_conda_env function in parisneo/lollms

A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and...

CVE-2024-3121 Remote Code Execution in create_conda_env function in parisneo/lollms

A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and...

CVE-2024-3121

Parisneo/lollms version 5.9.0 is affected by CVE-2024-3121. The issue resides in create_conda_env, where unsafely using subprocess.Popen with shell=True injects commands via env_name and python_version, enabling Remote Code Execution. The vulnerability is demonstrated by potential execution of co...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution offers multiple payment methods, short message alerts and product image zoom. A security vulnerability exists in PrestaShop productsalert prior to version 1.7.4, which stems from sensitive...