20111 matches found
CVE-2024-37895
Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issu...
CVE-2024-37895
CVE-2024-37895 affects Lobe Chat, an open-source LLM/AI chat framework. In affected versions, if an attacker can authenticate via SSO/Access Code, they can modify the frontend base URL to point to a malicious attack URL and trigger a server-side request, enabling retrieval of the real backend API...
CVE-2024-37890
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] e55e510 and backported to [email protected] 22c2876, [email protected] eeb76d3, and [email protected]...
Important: Red Hat Security Advisory: firefox security update
An update for firefox is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as...
What is DevSecOps and Why is it Essential for Secure Software Delivery?
Traditional application security practices are not effective in the modern DevOps world. When security scans are run only at the end of the software delivery lifecycle either right before or after a service is deployed, the ensuing process of compiling and fixing vulnerabilities creates massive...
NiceRAT Malware Targets South Korean Users via Cracked Software
Threat actors have been observed deploying a malware called NiceRAT to co-opt infected devices into a botnet. The attacks, which target South Korean users, are designed to propagate the malware under the guise of cracked software, such as Microsoft Windows, or tools that purport to offer license...
StrongShop Cross-Site Scripting Vulnerability
StrongShop is a free and open source cross-border e-commerce mall website by StrongShop Open Source. A cross-site scripting vulnerability exists in StrongShop v1.0, which originates from a cross-site scripting vulnerability in the id parameter of /view/admin/view.php...
Mozilla Firefox Spoofing Vulnerability (CNVD-2024-29137)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A spoofing vulnerability exists in versions of Mozilla Firefox prior to 127, which can be exploited by an attacker to spoof the location URL bar...
itsourcecode Real Estate Management System SQL Injection Vulnerability
Real Estate Management System is an open source real estate management system from Itsourcecode. SQL injection vulnerability exists in itsourcecode Real Estate Management System version 1.0, the vulnerability stems from property-detail.php contains some unknown functions, which can cause SQL...
RLSA-2024:3783 Moderate: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.11.0 ESR. Security Fixes: firefox: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 firefox: IndexedDB files retained in private browsi...
[SECURITY] Fedora 39 Update: chromium-126.0.6478.55-1.fc39
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 40 Update: chromium-126.0.6478.55-1.fc40
Chromium is an open-source web browser, powered by WebKit Blink...
MeterSphere Cross-Site Scripting Vulnerability
MeterSphere is MeterSphere open source one-stop open source continuous testing platform. MeterSphere 1.10.1-lts previous versions of cross-site scripting vulnerability , the vulnerability stems from the application of the user-supplied data lack of effective filtering and escaping , an attacker c...
Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-29140)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by attackers to bypass security restrictions...
Mozilla Firefox post-release reuse vulnerability (CNVD-2024-29144)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox is prone to a post-release reuse vulnerability that can be exploited by an attacker to execute arbitrary code on the system...
MyFinances Security Vulnerabilities
MyFinances is an open source web application from TreyWW Open Source. Designed to enable individuals and teams to manage their finances effectively. A security vulnerability exists in versions of MyFinances prior to 0.4.6 that stems from a method to access other customer invoices while logged in ...
Mozilla Firefox Denial of Service Vulnerability (CNVD-2024-36727)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a denial-of-service vulnerability caused by out-of-memory due to the use of an allocation in the probabilistic heap checker at a specific point. An attacker can exploit the...
Mozilla Firefox Spoofing Vulnerability (CNVD-2024-36728)
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox has a spoofing vulnerability that can be exploited by attackers to spoof the address bar...
Nextcloud Security Breach
Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server that stems from a second factor of 2FA that can be bypassed in some cases by successfully providing use...