1000 Projects Attendance Tracking Management System 注入漏洞

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. 1000 Projects Attendance Tracking Management System version 1.0 suffers from an injection vulnerability, which originates from the parameter facultycourseid in the file...

[SECURITY] Fedora 40 Update: chromium-131.0.6778.204-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

REDCap 安全漏洞

REDCap is a data collection and management web application from REDCap Open Source. A security vulnerability exists in REDCap 15.0.0 and earlier versions, which stems from a lack of cross-site request forgery protection in the logout functionality, which allows an attacker to trigger a logout...

Malicious code in app-settings-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eb5bad98414af86d07823241157507b0c2c71fb619cb487fb0a126587fa9ae8e The OpenSSF Package Analysis project identified 'app-settings-template' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

code-projects Job Recruitment 代码注入漏洞

Code-Projects Job Recruitment is an open source job portal by Code-Projects. A code injection vulnerability exists in code-projects Job Recruitment version 1.0, which stems from the parameter email being vulnerable to cross-site scripting attacks...

Codezips E-Commerce Website 注入漏洞

Codezips E-Commerce Website is an open source e-commerce website by Codezips. An injection vulnerability exists in Codezips E-Commerce Website version 1.0, which originates from an SQL injection in the parameter email...

Stardust 访问控制错误漏洞

Stardust is a spaceness open source platform for streaming isolated desktop containers. An access control error vulnerability exists in Stardust. An attacker exploiting this vulnerability could access another container's proxy...

ClassCMS Code Injection Vulnerability

ClassCMS is China ClassCMS open source a simple , flexible , secure , easy to expand the content management system . ClassCMS 4.8 version of the code injection vulnerability , an attacker can exploit the vulnerability leads to cross-site scripting attacks...

CVE-2024-49765

CVE-2024-49765 affects Discourse where sites enabling Discourse Connect alongside local login methods could allow an attacker to bypass Discourse Connect to create accounts and log in. The issue is described as a bypass of login paths rather than a remote exploit; affected component is the Discou...

CVE-2024-52794 Magnific lightbox susceptible to Cross-site Scripting in Discourse

Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability...

itsourcecode Vehicle Management System 注入漏洞

itsourcecode Vehicle Management System is an open source vehicle management system from itsourcecode. An injection vulnerability exists in version 1.0 of itsourcecode Vehicle Management System, which stems from an SQL injection vulnerability in the idcabs parameter of the editbill.php file...

NagVis 安全漏洞

NagVis is a program from NagVis open source. Used to visualize your chosen monitoring core data in a user-friendly way. A security vulnerability existed prior to Nagvis version 1.9.42, which stemmed from improper neutralization of input and could lead to a cross-site scripting vulnerability...

1000 Projects Attendance Tracking Management System 注入漏洞

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. An injection vulnerability exists in 1000 Projects Attendance Tracking Management System version 1.0, which originates from an SQL injection vulnerability in the studentemailid...

CVE-2024-52590 Missing validation allows spoofed profiles in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to...

CVE-2024-55952 Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability

DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. Constructing the host as...

CVE-2024-55953 Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability

DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised ...

Not Your Old ActiveState: Introducing our End-to-End OS Platform

Having been at ActiveState for nearly eight years, I've seen many iterations of our product. However, one thing has stayed true over the years: Our commitment to the open source community and companies using open source in their code. ActiveState has been helping enterprises manage open source fo...

Malicious code in baby-loris (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9155edd098ee3fed04541b192087704f5a42b1f149bdd0f4f487d7e0ae941870 The OpenSSF Package Analysis project identified 'baby-loris' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

Envoy Proxy 安全漏洞

Envoy Proxy is a cloud-native, high-performance edge/intermediate/service proxy open-sourced by Envoy Proxy. A security vulnerability exists in Envoy Proxy that stems from the fact that sending a payload when resetting a request early could lead to a crash...

FORT Validator 安全漏洞

FORT Validator is a NICMx open source RPKI dependency and RTR server. A security vulnerability exists in FORT Validator version 1.6.4 and earlier, which stems from a validation integrity issue that could lead to incomplete routing origin validation data...