LoLLMs 安全漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to v9.8, which stems from an unverified path connection in the servejs function in app.py. An attacker exploiting this vulnerability can...

CVE-2024-23957

Autel MaxiCharger AC Elite Business C50 DLBHostHeartBeat Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 charging stations...

MAL-2024-9014 Malicious code in testdjallal-ui-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1743902cfe9e18cf0f325f256d6df25de8dbc811261f10d3c0f1861584e90b19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9010 Malicious code in dexopener (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 383494a46b5dda6304fe18cebe523b008c84c912c4b77735a5959c787c246e76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9011 Malicious code in laodasher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9531a1025abaa38f76157303633cc7bacd5741f602149042d8f9ac55c78b75a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in multiple-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da4233e3b39779d62d23e578c4ceb25ff5a78a6f0285b709b91ef0cf36ed7d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9009 Malicious code in autocomplete-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cd596b11e151bc765536ac31d81e6203896f3f04dbbf52913aa3b6f1fd2c3e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9013 Malicious code in multiple-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da4233e3b39779d62d23e578c4ceb25ff5a78a6f0285b709b91ef0cf36ed7d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8988 Malicious code in djangopeople (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 914774dbbe9905d4a82b6488d9387f25bbac12cc4ce19fd920a3914dd23ba015 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8990 Malicious code in poolpairs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebb978ca1e587144e4ad0da4ddd79f512a198c09e643e88ff1e2274927820b29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-47130

The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your app to the current release for enhanced encryption protocols...

CVE-2024-47130

The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your app to the current release for enhanced encryption protocols...

CVE-2024-47122

In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device EUD. This allows for complete decryption of keys stored on the EUD if physically compromised. This allows an attacker to decrypt all encrypted broadcast communications based on encryption keys...

CVE-2024-47122

In the goTenna Pro App, the encryption keys are stored along with a static IV on the End User Device EUD. This allows for complete decryption of keys stored on the EUD if physically compromised. This allows an attacker to decrypt all encrypted broadcast communications based on encryption keys...

CVE-2024-47125

The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to the current release for enhanced encryption protocols...

CVE-2024-47126

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an...

CVE-2024-45374

The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent vi...

CVE-2024-45723

The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast ...

CVE-2024-43694

In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based on broadcast keys stored on the device...

CVE-2024-43694

In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete decryption of keys stored on the device. This allows an attacker to decrypt all encrypted broadcast communications based on broadcast keys stored on the device...