Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027

The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning paths, by combining together modules, courses, and other activities, ordering them, and defining conditional rules for the transitions from one step to the next one. An administrati...

RHEL 8 : python-setuptools (RHSA-2024:5000)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5000 advisory. The python-setuptools package provides a collection of enhancements to Python distribution utilities allowing convenient building and distribution of...

[SECURITY] [DSA 5735-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5735-1 [email protected] https://www.debian.org/security/ Andres Salomon July 31, 2024 https://www.debian.org/security/faq -...

Threat actor impersonates Google via fake ad for Authenticator

We have previously reported on the brand impersonation issue with Google ads: users who search for popular keywords are shown malicious ads that purport to be from an official vendor. Not only does this trick innocent victims into downloading malware or losing their data to phishing sites, it als...

'Stargazer Goblin' Creates 3,000 Fake GitHub Accounts for Malware Spread

A threat actor known as Stargazer Goblin has set up a network of inauthentic GitHub accounts to fuel a Distribution-as-a-Service DaaS that propagates a variety of information-stealing malware and netting them $100,000 in illicit profits over the past year. The network, which comprises over 3,000...

[SECURITY] [DSA 5734-2] bind9 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-5734-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 27, 2024 https://www.debian.org/security/faq -...

CVE-2024-7057

An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where job artifacts can be inappropriately exposed to users lacking the proper authorization level...

CVE-2024-0231

A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits...

How to Securely Onboard New Employees Without Sharing Temporary Passwords

The initial onboarding stage is a crucial step for both employees and employers. However, this process often involves the practice of sharing temporary first-day passwords, which can expose organizations to security risks. Traditionally, IT departments have been cornered into either sharing...

Experts Uncover Chinese Cybercrime Network Behind Gambling and Human Trafficking

--- The relationship between various TDSs and DNS associated with Vigorish Viper and the final landing experience for the user A Chinese organized crime syndicate with links to money laundering and human trafficking across Southeast Asia has been using an advanced "technology suite" that runs the...

[SECURITY] [DSA 5733-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5733-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 18, 2024 https://www.debian.org/security/faq -...

Geoserver Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Geoserver unauthenticated Remote Code Execution', 'Description' = %q GeoServer is an open-source software server written in Java that provides th...

How to Configure Automatic Virtual Disk Updates

This article contains information about how to use the Provisioning Services Automatic vDisk Update process. Background The vDisks assigned to the clients during the Automatic vDisk Update process are new versions of the vDisks currently assigned to the clients; allowing for the automatic...

CVE-2024-6035

A Stored Cross-Site Scripting XSS vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser...

PYSEC-2024-61

A Stored Cross-Site Scripting XSS vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser...

CVE-2024-6035 Stored XSS in gaizhenbiao/chuanhuchatgpt

A Stored Cross-Site Scripting XSS vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser...

CVE-2024-6035 Stored XSS in gaizhenbiao/chuanhuchatgpt

A Stored Cross-Site Scripting XSS vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser...

CVE-2024-6035

CVE-2024-6035 is a Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410. An attacker can inject malicious JavaScript into the chat history file, and when a victim uploads this file the script executes in the victim’s browser, potentially enabling user data theft, session hijack...

ChuanhuChatGPT Cross-Site Scripting Vulnerability

ChuanhuChatGPT is a lightweight and easy-to-use Web GUI for ChatGPT/ChatGLM/LLaMA/StableLM/MOSS and many other LLMs. A cross-site scripting vulnerability exists in ChuanhuChatGPT version 20240410, which originated from allowing an attacker to inject malicious JavaScript code into a chat log file,...

[SECURITY] [DSA 5727-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5727-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 10, 2024 https://www.debian.org/security/faq -...