DataEase 安全漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends for business improvement and optimization. A security vulnerability exists in DataEase versions prior to 2.10.4, which ste...

path-to-regexp 安全漏洞

Path-to-RegExp is an open source tool from pillarjs. It is used to convert path strings to regular expressions. A security vulnerability exists in versions prior to path-to-regexp 0.1.12. An attacker exploiting this vulnerability can cause poor performance...

CVE-2024-43784 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit a...

Cachi2 安全漏洞

Cachi2 is an open source CLI tool from containerbuildsystem. A security vulnerability exists in Cachi2 versions prior to 0.14.0, which stems from the fact that the tool logs each function's local variables when an unhandled exception is triggered, potentially leading to the display of secret...

Prompt Injection Defenses Against LLM Cyberattacks

Interesting research: "Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks": Large language models LLMs are increasingly being harnessed to automate cyberattacks, making sophisticated exploits more accessible and scalable. In response, we propose a new defens...

Enalean Tuleap 安全漏洞

Enalean Tuleap is a free and open source tool from the French company Enalean. It is used for end-to-end traceability of application and system development. A security vulnerability exists in Enalean Tuleap. An attacker exploiting the vulnerability could view tracker names that they should not ha...

DataEase 代码问题漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. Used to help users quickly analyze data and insight into business trends , so as to achieve business improvement and optimization . A code issue vulnerability exists in versions prior to DataEase v1.18.25...

UBUNTU-CVE-2024-45618

A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have...

Probate Back Office 注入漏洞

Probate Back Office is an open source tool from HM Courts & Tribunals Service. An injection vulnerability exists in Probate Back Office c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31 and prior versions, which stems from an unknown function in the Markdown Handler component and could lead to an injectio...

Flowise 安全漏洞

Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise version 1.8.2, which results in a denial of service due to improper handling of user-supplied input to the "/api/v1/get-upload-file" api endpoint...

VNote Security Vulnerability

VNote is an open source cross-platform Markdown note-taking tool from VNote Open Source. A security vulnerability exists in VNote versions prior to 3.18.1, which stems from the presence of a code execution vulnerability that could allow an attacker to execute arbitrary programs on the victim's...

AJ-Report SQL Injection Vulnerability (CNVD-2024-34975)

AJ-Report is a fully open source, drag-and-drop editing visualization design tool. AJ-Report version 1.4.1 suffers from a SQL injection vulnerability, which can be exploited by an attacker to send specially crafted SQL statements to the /pageList script using the 'p' parameter to view, add, modif...

AJ-Report 代码问题漏洞

AJ-Report is a fully open source, drag-and-drop editing visual design tool from anji-plus open source. A code issue vulnerability exists in anji-plus AJ-Report 1.4.1 and earlier versions, which stems from a deserialization vulnerability in the component...

Unspecified Vulnerability in DataEase (CNVD-2024-20785)

DataEase is an open source data visualization and analysis tool. Used to help users quickly analyze data and gain insight into business trends , so as to achieve business improvement and optimization . A security vulnerability exists in DataEase versions prior to 2.5.0. Attackers can use this...

OpenSC Resource Management Error Vulnerability

OpenSC is an open source smart card tool and middleware. OpenSC suffers from a resource management error vulnerability that stems from the presence of a post-release reuse vulnerability...

PYSEC-2024-126

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

...

Label Studio Security Vulnerability

Label Studio is an open source data labeling tool from Heartex Open Source. Allows you to use a simple and clear UI mark audio, text, images, video and time series and other data types , and exported to a variety of model formats. A security vulnerability exists in Label Studio versions prior to...

Exploit for CVE-2023-38646

CVE-2023-38646 PoC Description This is a Proof of Concept...

New OS Tool Tells You Who Has Access to What Data

Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential ...