Trix 跨站脚本漏洞

Trix is a Basecamp open source rich text editor for everyday writing. A cross-site scripting vulnerability exists in Trix versions prior to 2.1.9 and prior to 1.3.3. The vulnerability stems from the susceptibility to cross-site scripting attacks when malicious code is pasted, which may result in...

RAGFlow 安全漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A security vulnerability exists in RAGFlow version 0.13.0, which stems from improper access control of document-hooks.ts and allows unauthorized access to user documents...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software from Sourceforge Open Source. It allows for comprehensive and efficient management of school operations. A security vulnerability exists in Unifiedtransform version 2.0 and prior versions, which stems from multiple access control...

Malicious code in less-rhino (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e73bfd1ed2aa0b8489fb39ddfc1ac2272730be0a23c877efe7ac2042216feb49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 40 Update: chromium-131.0.6778.108-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

Mozilla Firefox: Multiple Vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Asterisk: Multiple Vulnerabilities

Background Asterisk is an open source telephony engine and toolkit. Description Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

CVE-2024-54136 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to...

Researchers Uncover Flaws in Popular Open-Source Machine Learning Frameworks

Cybersecurity researchers have disclosed multiple security flaws impacting open-source machine learning ML tools and frameworks such as MLflow, H2O, PyTorch, and MLeap that could pave the way for code execution. The vulnerabilities, discovered by JFrog, are part of a broader collection of 22...

Malicious code in asuuuuu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 40d2219a3e70e5af240f63d41ab082cad543b84acf2abd045011db292bc69654 The OpenSSF Package Analysis project identified 'asuuuuu' @ 3.1.3 npm as malicious. It is considered malicious because: - The package communicat...

Snyk Code Agent 安全漏洞

Snyk Code Agent is an agent from Snyk open source. A security vulnerability exists in Snyk Code Agent. An attacker exploiting this vulnerability could execute arbitrary code inside the Code Agent container...

Apache NimBLE Buffer Overflow Vulnerability

Apache NimBLE is an open source Bluetooth 5.4 stack host and controller from the Apache Foundation, USA, that completely replaces the proprietary SoftDevice on Nordic chipsets.It is part of the Apache Mynewt project. Apache NimBLE suffers from a buffer overflow vulnerability that can be exploited...

1000 Projects Beauty Parlour Management System 注入漏洞

1000 Projects Beauty Parlour Management System is an open source beauty parlor management system from 1000 Projects. An injection vulnerability exists in 1000 Projects Beauty Parlour Management System version 1.0, which is caused by an SQL injection in the parameter name...

1000 Projects Library Management System 安全漏洞

1000 Projects Library Management System is an open source library management system from 1000 Projects. A security vulnerability exists in 1000 Projects Library Management System version 1.0 due to an SQL injection in the parameter useri...

Code-Projects Simple CRUD Functionality 代码注入漏洞

Code-Projects Simple CRUD Functionality is a Code-Projects open source web application. Code-Projects Simple CRUD Functionality version 1.0 suffers from a code injection vulnerability that stems from the vulnerability to cross-site scripting attacks via the newtitle/newdescr parameter...

path-to-regexp 安全漏洞

Path-to-RegExp is an open source tool from pillarjs. It is used to convert path strings to regular expressions. A security vulnerability exists in versions prior to path-to-regexp 0.1.12. An attacker exploiting this vulnerability can cause poor performance...

1000 Projects Library Management System 安全漏洞

1000 Projects Library Management System is an open source library management system from 1000 Projects. A security vulnerability exists in 1000 Projects Library Management System version 1.0 due to a SQL injection in parameter q. The vulnerability is caused by the presence of a parameter q in the...

Malicious code in private-lib-bug-bounty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef8c8e73b8b4d3414d06cadfd08f308a41276fe31204d26bc85d1eb566c4923c The OpenSSF Package Analysis project identified 'private-lib-bug-bounty' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in vue-midata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc06ec1e2eb7c0a1bd2a27e81568ad8ee48c80f63b74284118e768a9740222e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Moderate: Red Hat Bug Fix Advisory: Updated rhel9/firefox-flatpak container image

An updated rhel9/firefox-flatpak container image is now available in the Red Hat container registry. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Flatpak is a system for running graphical applications as containers. Installing an...