GitLab CE/EE Security Vulnerabilities

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab CE/EE, which stems from a vulnerability that...

ALSA-2024:3835 Important: libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...

Update: CVE-2024-4577 quickly weaponized to distribute “TellYouThePass” Ransomware

Introduction Recently, Imperva Threat Research reported on attacker activity leveraging the new PHP vulnerability, CVE-2024-4577. From as early as June 8th, we have detected attacker activity leveraging this vulnerability to deliver malware, which we have now identified to be a part of the...

SUSE CVE-2024-23793

The file upload feature in OTRS and OTRS Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl...

CVE-2024-30162

Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\toolbar::addPlugin method. This method handles uploaded ZIP files that are extracted into the...

CVE-2024-30163

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\store::categoryView method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries...

CVE-2024-30163

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\store::categoryView method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries...

Invision Community Security Breach

Invision Community is a software for designing and developing mobile application UI from Invision Inc. in the United States. A security vulnerability exists in Invision Community 4.7.16 and earlier versions, which is caused by a failure to properly validate the contents of an uploaded ZIP file wh...

CVE-2024-30162

Invision Community is affected through version 4.7.16 (and prior to 4.7.17 per PT-2024-23216) by a remote code execution vulnerability in the admin/editor toolbar addPlugin() handler. The issue stems from handling uploaded ZIPs that are extracted into the ckeditor/plugins/ directory without conte...

Invision Community Security Breach

Invision Community is a software for designing and developing mobile application UI from Invision USA. A security vulnerability exists in Invision Community versions prior to 4.7.16 that stems from the application failing to properly clean up request parameters, which can be exploited by an...

CVE-2024-30163

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\store::categoryView method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries...

CVE-2024-30163

Summary (CVE-2024-30163): IPS Community Suite prior to 4.7.16 is affected by an unauthenticated SQL injection in the store.php path, specifically IPS\nexus\modules\front\store_store::_categoryView() where input passed via filter is not sanitized before SQL execution. This allows blind SQL injecti...

CVE-2024-30163

Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\store::categoryView method, where user input passed through the filter request parameter is not properly sanitized before being used to execute SQL queries...

CVE-2024-30162

Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\toolbar::addPlugin method. This method handles uploaded ZIP files that are extracted into the...

CVE-2024-30162

Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\toolbar::addPlugin method. This method handles uploaded ZIP files that are extracted into the...

a-data-processing (=0.0.1), ab-data-processing (=0.0.1) +490 more potentially affected by CVE-2024-2965 via langchain-community (>=0.0.1 <=0.2.4)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.0.1, =0.1.0, =0.0.1, =0.0.18, =0.2.0, =0.0.1, =0.0.2, =0.0.1, =0.0.4a1 - aicat-annotator =0.0.1 and more Source cves: CVE-2024-2965 Source advisory: OSV:GHSA-3HJH-JH2H-VRG6...

a-data-processing (=0.0.1), ab-data-processing (=0.0.1) +515 more potentially affected by CVE-2024-3095 via langchain-community (>=0.0.1 <=0.2.7)

langchain-community PYPI version =0.0.1, =0.1.0, =0.0.2, =0.0.1, =0.1.0, =0.0.1, =0.0.18, =0.2.0, =0.0.1, =0.0.2, =0.0.1, =0.0.4a1 - aicat-annotator =0.0.1 and more Source cves: CVE-2024-3095 Source advisory: OSV:GHSA-Q25C-C977-4CMH...

GHSA-3HJH-JH2H-VRG6 Denial of service in langchain-community

Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parsesitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap...

CVE-2024-23793

The file upload feature in OTRS and OTRS Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl...

UBUNTU-CVE-2024-23793

The file upload feature in OTRS and OTRS Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl...