CVE-2024-47070 authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header

authentik is an open-source identity provider. A vulnerability that exists in versions prior to 2024.8.3 and 2024.6.5 allows bypassing password login by adding X-Forwarded-For header with an unparsable IP address, e.g. a. This results in a possibility of logging into any account with a known logi...

RPShare 安全漏洞

RPShare is a client-side Fabric mod and server-side Paper plugin open-sourced by Plasmo. It allows players to quickly share resource packs. A security vulnerability exists in RPShare version v.1.0.0, which stems from the presence of a directory traversal vulnerability that allows remote attackers...

freeimage 安全漏洞

FreeImage is FreeImage open source a cross-platform for supporting popular graphic image formats open source library . freeimage has a buffer overflow vulnerability , the vulnerability stems from the size of the configuration file is not cleaned up , an attacker can use this vulnerability to caus...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik Open Source. A security vulnerability exists in authentik that stems from the fact that users can steal their legitimately obtained access tokens and use them to access other applications that they are not authorized to...

RHEL 9 : grafana (RHSA-2024:7202)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:7202 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: encoding/gob: golang:...

cups 输入验证错误漏洞

CUPS is a standards-based open source printing system. An input validation error vulnerability exists in CUPS libppd, which can be exploited by an attacker to execute arbitrary code on the system...

Mattermost 安全漏洞

Mattermost is an open source, self-hosted, enterprise-class chat platform that provides secure team communication and collaboration capabilities. A resource-consuming vulnerability exists in Mattermost. An attacker could exploit this vulnerability to cause a service down or denial of service...

Grafana Agent 安全漏洞

Grafana Agent is an OpenTry Collector distribution of Grafana open source. A security vulnerability exists in Grafana Agent versions prior to 0.43.2 that stems from an unquoted search path or element vulnerability that allows elevation of privilege...

Malicious code in storj-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c29c7e82f958f9ed89af6fc324d687bfe4e15d4b2aa49fee39f5aeeb4eee5583 The OpenSSF Package Analysis project identified 'storj-docs' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Exploit for Server-Side Request Forgery in Lobehub Lobe_Chat

CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ Descr...

Unspecified Vulnerability in SeaCMS (CNVD-2024-39253)

SeaCMS is a free, open source web content management system written in PHP by SeaCMS. The system has been designed primarily to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 13.2, which can be exploited by an attacker to execute arbitrary code on the server b...

CVE-2024-40441

An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the modelattribs parameter...

CVE-2024-40442

An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via a crafted REST Request...

CVE-2024-47069

CVE-2024-47069 affects the Oveleon contao-cookiebar extension for Contao CMS. The vulnerability is in the block/locale endpoint where user-controlled locale input is not properly sanitized before being echoed in the backend HTTP response, causing reflected XSS. Affected versions are before 1.16.3...

CVE-2024-47069 Oveleon Cookiebar reflected Cross-site Scripting vulnerability

Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the...

CVE-2024-47069 Oveleon Cookiebar reflected Cross-site Scripting vulnerability

Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the...

CVE-2024-47066

CVE-2024-47066 (Lobe Chat) is an SSRF issue in Lobe Chat prior to version 1.19.13 where server-side proxy protection in src/app/api/proxy/route.ts does not handle redirects, allowing an attacker-supplied URL to redirect to internal resources (e.g., private networks or loopback). The vulnerability...

[SECURITY] Fedora 41 Update: chromium-129.0.6668.58-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2024-40442

An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via a crafted REST Request...

Centreon 安全漏洞

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for network, system and application resources. A security vulnerability exists in Centreon version 24.04.2. An attacker can exploit this...