Malicious code in ductai-chatbot-community (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27c77e0ede4c194a2280a25afb09eab42f56783293849e1ceb66bb39b6f62477 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-40997

Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via a crafted packet...

Buffer overflow

Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via a crafted packet...

CVE-2023-40998

The CVE-2023-40998 issue affects the O-RAN Software Community ric-plt-lib-rmr v.4.9.0, specifically a buffer overflow in the packet size component that enables remote denial of service. Multiple sources (Red Hat, NVD, CNNVD, CVE records, PT Security) confirm the same vulnerability description. Ex...

CVE-2023-40998: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via the packet size component...

CVE-2023-40997

CVE-2023-40997 concerns a buffer overflow in the O-RAN Software Community ric-plt-lib-rmr v4.9.0. The vulnerability allows a remote attacker to cause a denial of service by sending a crafted network packet. Affected component: ric-plt-lib-rmr (library within O-RAN software). Root cause: buffer ov...

CVE-2023-38508

Summary: CVE-2023-38508 affects Tuleap: Community Edition < 14.11.99.28 and Enterprise Edition < 14.10-6,

Tuleap cross-site scripting vulnerabilities

Tuleap is an open source application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. A cross-site scripting vulnerability exists in Tuleap that stems from not properly escaping the contents of...

PT-2023-26993 · Unknown · Tuleap Community Edition +1

Name of the Vulnerable Software and Affected Versions: Tuleap Community Edition versions prior to 14.11.99.28 Tuleap Enterprise Edition versions prior to 14.10-6 Tuleap Enterprise Edition versions prior to 14.11-3 Description: The issue arises from content not being properly escaped in the "card...

Tuleap security vulnerabilities

Tuleap is an open source application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. A security vulnerability exists in Tuleap that stems from the presence of a privilege control error issue...

Cisco Firepower 4100 Series, Firepower 9300 Security Appliances, and UCS 6300 Series Fabric Interconnects SNMP Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300 Security Appliances and of Cisco UCS 6300 Series Fabric Interconnects could allow an authenticated, remote attacker to cause a denial of service DoS condition...

SheetJS Community Edition Prototype Pollution

The vulnerability of the SheetJS Community Edition NPM package is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a malicious actor to execute a “prototype pollution” attack using a specially crafted xlsx file...

CVE-2023-40165

rubygems.org is the Ruby community's primary gem library hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching /-\d/, permanently replacing the legitimate upload in the canonical gem...

Input validation

rubygems.org is the Ruby community's primary gem library hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching /-\d/, permanently replacing the legitimate upload in the canonical gem...

CVE-2023-40165 Unauthorized gem replacement for full names ending in numbers on rubygems.org

rubygems.org is the Ruby community's primary gem library hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching /-\d/, permanently replacing the legitimate upload in the canonical gem...

CVE-2023-40165 Unauthorized gem replacement for full names ending in numbers on rubygems.org

rubygems.org is the Ruby community's primary gem library hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching /-\d/, permanently replacing the legitimate upload in the canonical gem...

Join us for VeloCON 2023: Digging Deeper Together!

September 13, 2023 at 9 am ET Rapid7 is thrilled to announce that the 2nd annual VeloCON: Digging Deeper Together virtual summit will be held this September 13th at 9 am ET. Once again, the conference will be online and completely free! VeloCON is a one-day event focused on the Velociraptor...

YouTube makes sweeping changes to tackle spam on Shorts videos

YouTube is rolling out unclickable links. Video portals like YouTube have had to deal with spam comments and bogus links for many years. With new additions to a platform come new places for scammers to go about their business. YouTube is now cracking down on links posted to the comments section o...

Vote tokens of voters are not returned.

Lines of code Vulnerability details Impact In the docs and twitter spaces, it was mentioned that the voting tokens will be given back to the voters after the Election has ended. But no logic is implemented anywhere in the repo. This can cause voters to lose their valuable voting tokens which can...

1Panel Security Vulnerability

1Panel is an open source Linux server operations and management panel for the Chinese 1panel community. A security vulnerability exists in 1Panel version 1.4.3, which stems from a lack of parameter filtering...