Khoj Security Vulnerabilities

Khoj is an open source application from Khoj AI. It can create ready-to-use personal AI agents for users. A security vulnerability exists in versions prior to Khoj 1.13.0 that stems from insufficient response to AI models and user input cleanup, which could lead to a cross-site scripting XSS...

Devika Cross-Site Scripting Vulnerability

Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches relevant information, and writes code to achieve a given goal. Devika suffers from a cross-site scripting vulnerability that stems from improper...

DEBIAN-CVE-2024-39484

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driver is builtin Using exit for the remove function results in the remove callback being discarded with CONFIGMMCDAVINCI=y. When such a device gets unbound e.g. using sysfs or...

Malicious code in @zitterorg/deserunt-beatae-fuga (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9102b6b1b9c0603fe9968c593b5a7500377a6ac0843e6595dc438c9b75e213f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/velit-occaecati (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e63adb86ef0ff581b6a33d4906768568a8a1f235ae161f03ed5e01dd6f1f2194 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/expedita-quasi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 422b14874a0462f719fa48a436f12e8606f4fce7f46142d02f14777d8c46f590 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/quibusdam-numquam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d100cc641d497e5bdffba82d8bf5e672268f965acea2403dde38c4a69eab7be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/accusantium-reprehenderit-quisquam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be1f228b74f15b3e0f922c3fa0c4b0eec8135b73e43e2cfe6b7535406bb05cdc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/dignissimos-doloremque-magnam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d87ebb1893495b74b563f0f42621c15a051580f9d0ddf7132cafbb8adaf49ee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zitterorg/libero-laudantium-unde (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 788c67c5ed955b93f0c7952f0de52cccf57fbe4a70ed297f5d5f23dda7c21289 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin Elementor Addons by Livemesh security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Deep Lake Security Breach

Deep Lake is an AI database open-sourced by Activeloop. Its storage format is optimized for deep learning applications. A security vulnerability exists in Deep Lake version 3.9.10, which stems from a lack of input cleanup and command injection when extracting remote Kaggle datasets...

WordPress plugin The Plus Addons for Elementor Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CBL Mariner 2.0 Security Update: bind (CVE-2023-6516)

The version of bind installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-6516 advisory. - To keep its cache database efficient, named running as a recursive resolver occasionally attempts to clean up t...

PT-2024-40997 · Podofo · Podofo

Name of the Vulnerable Software and Affected Versions: podofo affected versions not specified Description: The issue concerns the validation of encrypt dictionary parameters in PdfEncrypt and the handling of invalid XRef stream entries in PdfXRefStreamParserObject. Additionally, there is a cleanu...

WordPress plugin Premium Addons for Elementor Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

kernel: net/mlx5e: Fix mlx5e_priv_init() cleanup flow

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix mlx5eprivinit cleanup flow The Linux kernel CVE team has assigned CVE-2024-35959 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052019-CVE-2024-35959-6e06@gregkh/T...

kernel: mISDN: fix possible use-after-free in HFC_cleanup()

A vulnerability was found in the Linux kernel's mISDN driver. This issue arises during the cleanup process, where a timer handler might still be running after the driver has been removed, which can lead to a use-after-free issue, potentially causing a system crash...

WordPress plugin Ultimate Blocks cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Google Golang Security Vulnerability

Google Golang is a static strongly typed, compiled language from Google.Go's syntax is close to that of C, but differs with respect to variable declarations.Go supports garbage collection.Go's parallel model is based on Tony Hall's Communicating Sequential Processes CSP, and other languages that...