Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the presence of a single-byte overflow...

CVE-2024-53276

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, an open CORS policy in app.js may allow an attacker to view the images of home-gallery when it is using the default settings. The following express middleware allows any website ...

CVE-2024-53276 GHSL-2024-092: Open CORS policy in home-gallery

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, an open CORS policy in app.js may allow an attacker to view the images of home-gallery when it is using the default settings. The following express middleware allows any website ...

CVE-2024-53275 GHSL-2024-091: DNS rebinding attack in home-gallery

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vulnerable to DNS rebinding. Home-gallery is set up without TLS and user authentication by default, leaving it vulnerable to DNS rebinding. I...

CVE-2024-54148 Gogs has a Path Traversal in file editing UI

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1...

Malicious code in powpeg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 888651be4245ed94e8c3c538181c95691f87e394e03ebe7d425abd55a1f95749 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Top Open Source API Security Tools

The modern world relies on Application Programming Interfaces APIs. They allow applications to communicate with each other, servers, and consumers to facilitate data sharing and simplify application development. Without them, the internet would be unrecognizable. However, APIs also present a...

1000 Projects Attendance Tracking Management System: Injection Vulnerabilities

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. 1000 Projects Attendance Tracking Management System version 1.0 suffers from an injection vulnerability, which originates from the parameter facultycourseid in the file...

[SECURITY] Fedora 40 Update: chromium-131.0.6778.204-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

REDCap security vulnerabilities

REDCap is a data collection and management web application from REDCap Open Source. A security vulnerability exists in REDCap 15.0.0 and earlier versions, which stems from a lack of cross-site request forgery protection in the logout functionality, which allows an attacker to trigger a logout...

Malicious code in app-settings-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eb5bad98414af86d07823241157507b0c2c71fb619cb487fb0a126587fa9ae8e The OpenSSF Package Analysis project identified 'app-settings-template' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Codezips E-Commerce Website has a vulnerability

Codezips E-Commerce Website is an open source e-commerce website by Codezips. An injection vulnerability exists in Codezips E-Commerce Website version 1.0, which originates from an SQL injection in the parameter email...

Code-Projects Job Recruitment: Code Injection Vulnerabilities

Code-Projects Job Recruitment is an open source job portal by Code-Projects. A code injection vulnerability exists in code-projects Job Recruitment version 1.0, which stems from the parameter email being vulnerable to cross-site scripting attacks...

ClassCMS Code Injection Vulnerability

ClassCMS is China ClassCMS open source a simple , flexible , secure , easy to expand the content management system . ClassCMS 4.8 version of the code injection vulnerability , an attacker can exploit the vulnerability leads to cross-site scripting attacks...

Stardust Access Control Vulnerability

Stardust is a spaceness open source platform for streaming isolated desktop containers. An access control error vulnerability exists in Stardust. An attacker exploiting this vulnerability could access another container's proxy...

CVE-2024-49765

CVE-2024-49765 affects Discourse where sites enabling Discourse Connect alongside local login methods could allow an attacker to bypass Discourse Connect to create accounts and log in. The issue is described as a bypass of login paths rather than a remote exploit; affected component is the Discou...

CVE-2024-52794 Magnific lightbox susceptible to Cross-site Scripting in Discourse

Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. This problem is patched in the latest version of Discourse. Users are advised to upgrade. There are no known workarounds for this vulnerability...

NagVis security vulnerability

NagVis is a program from NagVis open source. Used to visualize your chosen monitoring core data in a user-friendly way. A security vulnerability existed prior to Nagvis version 1.9.42, which stemmed from improper neutralization of input and could lead to a cross-site scripting vulnerability...

Itsourcecode Vehicle Management System injection vulnerability

itsourcecode Vehicle Management System is an open source vehicle management system from itsourcecode. An injection vulnerability exists in version 1.0 of itsourcecode Vehicle Management System, which stems from an SQL injection vulnerability in the idcabs parameter of the editbill.php file...

1000 Projects Attendance Tracking Management System: Injection Vulnerabilities

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. An injection vulnerability exists in 1000 Projects Attendance Tracking Management System version 1.0, which originates from an SQL injection vulnerability in the studentemailid...