GitHub Actions Vulnerable to Typosquatting, Exposing Developers to Hidden Malicious Code

Threat actors have long leveraged typosquatting as a means to trick unsuspecting users into visiting malicious websites or downloading booby-trapped software and packages. These attacks typically involve registering domains or packages with names slightly altered from their legitimate counterpart...

CVE-2024-45299 alf.io's preloaded data as json is not escaped correctly

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-115.15.0-i686-1slack15.0.txz: Upgraded. This release contains security fixes and improvements. For mo...

MAL-2024-8822 Malicious code in tappp-tv-ui-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b52ed9fb8d53c0432591a5d59422157e0340b1851686826a972f0ecd8fd1dbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45392 SuiteCRM has wrong deletion permission checks on API delete call

SuiteCRM is an open-source customer relationship management CRM system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue...

WindMill 安全漏洞

WindMill is a free and open source tool from the individual developer Lukasavicus. It is used to control job execution in Python. A security vulnerability exists in WindMill version 1.380.0 that stems from an improper restriction of excessive authentication attempts...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-39480)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by attackers to bypass security restrictions...

CVE-2024-45620

A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accesse...

AZL-48757 CVE-2024-45619 affecting package opensc for versions less than 0.26.1-1

A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer...

UBUNTU-CVE-2024-45618

A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/seamonkey-2.53.19-i686-1slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see:...

Malicious code in mhnumjp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 371f7362253fbbd65f7a86aac45e8363e35760789892d19b77a4a09ee4d76ecf The OpenSSF Package Analysis project identified 'mhnumjp' @ 1.999.1 npm as malicious. It is considered malicious because: - The package...

CVE-2024-45306

A heap-buffer overflow was found in Vim. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. It was assumed that this loop was...

The vulnerability of the ngx_http_v4_module in NGINX Plus and NGINX OSS web servers, related to reading data from outside of memory, allows attackers to cause service interruptions.

The vulnerability of the ngxhttpv4module in NGINX Plus and NGINX OSS web servers is related to reading data from outside of the memory boundaries. Exploiting this vulnerability can allow attackers to cause service failures...

SudoBot 安全漏洞

SudoBot is an open source Discord audit bot from OneSoftNet. A security vulnerability exists in versions of SudoBot prior to 9.26.7 that stems from improper privilege control of the -config command, which could allow an unauthorized user to update any of the robot's configurations and gain contro...

SeaCMS 安全漏洞

SeaCMS is a free, open source web content management system written in PHP by SeaCMS. The system has been designed primarily to manage video-on-demand resources. SeaCMS suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary web script or HTML v...

CVE-2024-45306 heap-buffer-overflow in Vim

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop ...

CVE-2024-43801 Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin

Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin Web UI e.g. via "view image" in a...

Malicious npm Packages Mimicking 'noblox.js' Compromise Roblox Developers' Systems

Roblox developers are the target of a persistent campaign that seeks to compromise systems through bogus npm packages, once again underscoring how threat actors continue to exploit the trust in the open-source ecosystem to deliver malware. "By mimicking the popular 'noblox.js' library, attackers...

Hoverfly 安全漏洞

Hoverfly is a lightweight open source API emulation tool open-sourced by SpectoLabs. A security vulnerability exists in Hoverfly versions prior to v1.10.3. An attacker exploiting the vulnerability could read arbitrary files from the server...