11755 matches found
CVE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse
Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...
CVE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse
Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...
CVE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse
Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...
CVE-2024-45297
Discourse (open source forum software) is affected by CVE-2024-45297: users can see topics labeled with hidden tags if they know the tag name, exposing restricted content. The issue has been patched in the latest stable, beta, and tests-passed releases; all users should upgrade. No public exploit...
Discourse 安全漏洞
Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email and chat rooms. A security vulnerability exists in Discourse that stems from allowing users to view topics with hidden labels with knowledge of the...
Finding a needle in a haystack: Machine learning at the forefront of threat hunting research
Introduction In the ever-evolving landscape of cybersecurity, logs, that is information collected from various sources like network devices, endpoints, and applications, plays a crucial role in identifying and responding to threats. By analyzing this data, organizations can detect anomalies,...
MAL-2024-12351 Malicious code in spy-ai (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d71096c3aa8cb143ba7fab208ab313a240e8f1f9846b17b947a01f729fc1864a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...
MAL-2024-12348 Malicious code in spiderai (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 cfee8e74f278d45135c11ee4ff3f18180cb2423e333934a8ba994f5e8ec48b9a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...
Malicious code in spiderai (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 cfee8e74f278d45135c11ee4ff3f18180cb2423e333934a8ba994f5e8ec48b9a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...
SUSE CVE-2024-9391
A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. This bug only affects Firefox Focus for Android. Other versions of Firefox are...
UBUNTU-CVE-2024-9395
A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox 131...
golang: archive/zip: Incorrect handling of certain ZIP files
A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next...
cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection
A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...
PT-2024-7792
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 131 Firefox Focus for Android versions prior to 131 Description A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing...
CVE-2024-28812
An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service on the local management network interface with hardcoded credentials allows attackers to access the appliance operating system with highest privileges via an SSH connection...
Infinera hiT 7300 安全漏洞
The Infinera hiT 7300 is a software-defined networking SDN-ready coherent packet-optical transport system from Infinera USA. A security vulnerability exists in the Infinera hiT 7300 version 5.60.50 that stems from a hidden SSH service with hard-coded credentials that allows an attacker to access...
PT-2024-22580 · Infinera · Infinera Hit 7300
Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: An issue was discovered in the web interface of the affected software, which contains hidden functionality. This allows a remote authenticated attacker to access reserved information by accessing...
Malicious code in botnetv2 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 c81380140d3b7a9d5dddf19a386bb1fc8b9b55044fefc32997fc3d2af9969fcb When running the module, basic information about the user and its location are collected and sent to the author. This is hidden from the user as the package...
Multiple vulnerabilities in TAKENAKA ENGINEERING digital video recorders
Overview Multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. contain multiple vulnerabilities listed below. Improper authentication CWE-287 - CVE-2024-41929 OS command injection CWE-78 - CVE-2024-43778 Hidden functionality CWE-912 - CVE-2024-47001 Yoshiki Mori, Ushimaru...
