ZZCMS 跨站脚本漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v.2023 and prior versions, which stems from a phpinfo function that discloses detailed information about the PHP environment, including server configuration, loaded modules, a...

CVE-2024-44820

A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before . The issue is located in the eginfo.php file at the path /3/E_bak5.1/upload/. When an attacker accesses this file using the query parameter phome=ShowPHPInfo , the application executes the phpinfo() function. This...

VMware Fusion 安全漏洞

VMware Fusion is a suite of virtual machine software from VMware, Inc. designed to run Windows applications on Macs. A security vulnerability exists in VMware Fusion that stems from the use of insecure environment variables, resulting in a code execution vulnerability...

CVE-2024-45313 Insecure default setting for Server Pro installed via Overleaf toolkit

Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 2024-07-17 or legacy docker-compose.yml from before 2024-08-28, the configuration for LaTeX compiles was insecure by default, requiring the administrator to enable the security...

MinIO Bootstrap Verify Information Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MinIO Bootstrap Verify Information Disclosure', 'Description' = %q MinIO is a Multi-Cloud Object Storage framework. In a cluster deployment...

`spam` project on PyPI compromised, malicious releases made

The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

GHSA-2R6G-7R83-JG72 `spam` project on PyPI compromised, malicious releases made

The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

`exotel` project on PyPI compromised, malicious release made

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

GHSA-X6XG-3FJ2-4PQ3 `exotel` project on PyPI compromised, malicious release made

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PT-2024-40522 · Pypi · Exotel

Name of the Vulnerable Software and Affected Versions: Exotel affected versions not specified Description: The issue concerns a compromise of the Exotel project on PyPI through a phishing attack, leading to a malicious release that downloads and runs malware during installation. This affects...

PT-2024-40032 · Pypi · Spam

Name of the Vulnerable Software and Affected Versions: spam project on PyPI affected versions not specified Description: The issue concerns a compromise of the spam project on PyPI via a phishing attack, leading to a malicious release that downloads and runs malware at install time by accessing...

Spring AI with NVIDIA LLM API

Spring AI now supports NVIDIA's Large Language Model API, offering integration with a wide range of models. By leveraging NVIDIA's OpenAI-compatible API, Spring AI allows developers to use NVIDIA's LLMs through the familiar Spring AI API. We'll explore how to configure and use the Spring AI OpenA...

GHSA-XJ87-MQVH-88W2 fish-shop/syntax-check Improper Neutralization of Delimiters

Impact Improper neutralisation of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input value used in a workflow. This has the potential for exposure or exfiltrati...

CVE-2024-42482

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

CVE-2024-42482

CVE-2024-42482 affects the GitHub action fish-shop/syntax-check used to validate fish shell files. The vulnerability arises from improper neutralization of delimiters in the pattern input, specifically the command separator ; and command substitution characters ( and ), enabling arbitrary command...

CVE-2024-42482 fish-shop/syntax-check Improper Neutralization of Delimiters

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

CVE-2024-42482 fish-shop/syntax-check Improper Neutralization of Delimiters

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

CVE-2024-42482 fish-shop/syntax-check Improper Neutralization of Delimiters

fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the pattern input specifically the command separator ; and command substitution characters and mean that arbitrary command injection is possible by modification of the input...

GO-2024-2998 Woodpecker's custom environment variables allow to alter execution flow of plugins in go.woodpecker-ci.org/woodpecker

Woodpecker's custom environment variables allow to alter execution flow of plugins in go.woodpecker-ci.org/woodpecker...

SUSE CVE-2024-41817

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The AppImage version ImageMagick might use an empty path when setting MAGICKCONFIGUREPATH and LDLIBRARYPATH environment variables while executing, which might lead to arbitrary code execution b...