WS-2021-0372

An issue was found in the "ibexa/post-install" PHP package before 1.0.4.1. The default configuration for platform.sh .platform.app.yaml allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those...

Malicious code in newpackagetest2024 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1e2e6f858089751c96fa15bde74d24a4dc6a68758e3ee4870a9c0d1f7c66d378 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in bestcolorsever2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa4352627d3e53d9bea22f4b439c0749f5a88407f6dda914fe43ca7612c5b101 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in bestcolorsever (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8335ea2981241d7eb1836338e2a942abf4f5096eb264b0ceb13e85ec435b6465 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in christmasmiraclemaker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64f06a86dd5b916af92fc3adf5c1e5638df9eaa156a1bc122e4e647f2aae236e Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12234 Malicious code in christmasmiraclemaker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64f06a86dd5b916af92fc3adf5c1e5638df9eaa156a1bc122e4e647f2aae236e Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in newpackagetest2025 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb87fd7186acc9af957e5155c0bfda87798fa733efdea43ff60f647c3eb439a0 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-12218 Malicious code in bettercolorstesting (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 607fc60886a9983c22c65cd01bb93585f27b0830f203f3b3b181ff12026ea036 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2024-11149 Malicious code in noirxnodemailer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfb5c01486942b32fea497d1b731b1d73ca00dbbcd6b588f8065e24b128b5805 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2018-9374

In installPackageLI of PackageManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

Mageia: Security Advisory (MGASA-2024-0375)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2024-12254 Malicious code in dgsinstaller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f90b0387462eccb87e3b6d3b542cfdcfe3083873083f00a7ac5120c64b800f98 Installing package downloads and install an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in dgsinstaller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f90b0387462eccb87e3b6d3b542cfdcfe3083873083f00a7ac5120c64b800f98 Installing package downloads and install an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

CVE-2024-10542

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 6.43.2. This makes it possible for...

[SECURITY] Fedora 40 Update: cobbler-3.3.7-1.fc40

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors,...

[SECURITY] Fedora 41 Update: cobbler-3.3.7-1.fc41

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors,...

[SECURITY] Fedora 39 Update: cobbler-3.3.7-1.fc39

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors,...

KLA77602 PE vulnerability in Microsoft Office

An elevation of privilege vulnerability was found in Microsoft Office. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2024-49038 Exploitation Related products Microsoft-Copilot-Studio CVE list CVE-2024-49038 critical Solution Install necessary updates...

Fedora: Security Advisory (FEDORA-2024-b3c4e8da81)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-52702

A stored cross-site scripting XSS vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter. NOTE: this is disputed by the Supplier because Website Name can only be set ...