CVE-2024-47529: Cleartext Storage of Sensitive Information

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting s...

FileSender security vulnerability

FileSender is an open source web application from FileSender that allows authenticated users to securely and easily send arbitrarily large files to other users. A security vulnerability exists in FileSender versions prior to 2.49, which stems from the presence of server-side template injection th...

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Summary The login functionality contains a reflected cross-site scripting XSS vulnerability. Note: This CVE only affects Open Source Edition, and not OpenC3 COSMOS Enterprise Edition Impact This issue may lead up to Remote Code Execution RCE. NOTE: The complete advisory with much more information...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: 115.16/128.3 ESR firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3...

PT-2024-30663 · Openc3 · Openc3 Cosmos Open Source Edition

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS Open Source Edition versions prior to 5.19.0 Description: The login functionality of OpenC3 COSMOS contains a reflected cross-site scripting XSS vulnerability. This issue may lead to Remote Code Execution RCE. The vulnerability...

CVE-2024-43795: Improper Neutralization of Input During Web Page Generation

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functionality contains a reflected cross-site scripting XSS vulnerability. This vulnerability is fixed in 5.19.0. Note: This CVE only affects Open Source Edition, and...

CVE-2024-47523

LibreNMS (PHP/MySQL/SNMP-based) has a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Transports Details field. The root cause is insufficient sanitization of user input in the Details section, allowing an attacker to inject JavaScript that executes in other users’ sessions. This aff...

CVE-2024-47528 LibreNMS Contains a Stored XSS via File Upload

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting XSS can be achieved by uploading a new Background for a Custom Map. Users with "admin" role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload...

GHSA-CC4G-M3G7-XMW8 Decidim has a cross-site scripting vulnerability in the version control page

Impact The version control feature used in resources is subject to potential cross-site scripting XSS attack through a malformed URL. Workarounds Not available References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized by Open Source Politics against Decidi...

CVE-2024-47071

OSS Endpoint Manager is an endpoint manager module for FreePBX. OSS Endpoint Manager module activation can allow authenticated web users unauthorized access to read system files with the permissions of the webserver process. This vulnerability is fixed in 14.0.4...

CVE-2024-45408 eLabFTW contains a direct and indirect information disclosure

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed something disabled by default, this extends to anyon...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability previously existed in Mozilla Firefox version 131, which stemmed from the inclusion of a memory security hole...

Cute_PNG buffer error vulnerability

cutepng is an application of cutepng open source. A buffer error vulnerability exists in cutepng version 1.05, which stems from a heap buffer overflow vulnerability contained in the cploadpngmem function at cutepng.h. The vulnerability is caused by the use of the cploadpngmem function at cutepng...

Cute_PNG buffer error vulnerability

cutepng is an application of cutepng open source. A buffer error vulnerability exists in cutepng version 1.05, which stems from a heap buffer overflow vulnerability contained in the cpstored function at cutepng.h. The vulnerability is caused by the use of the cpstored function...

eLabFTW security vulnerabilities

eLabFTW is an open source experimental data hosting platform from eLabFTW Open Source. The platform runs on Linux and supports storing a wide range of objects. A security vulnerability exists in eLabFTW that stems from allowing initially unauthenticated users to gain administrative access to...

Decidim has a cross-site scripting vulnerability in the version control page

Impact The version control feature used in resources is subject to potential cross-site scripting XSS attack through a malformed URL. Workarounds Not available References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized by Open Source Politics against Decidi...

RLSA-2024:6681 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: 115.15/128.2 ESR mozilla: Type confusion when looking up a property name in a "with" block CVE-2024-8381 mozilla: Internal event interfaces were exposed to web...

grafana security update

An update is available for grafana. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...

Unspecified vulnerability in Linux kernel (CNVD-2024-40288)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from allowing out-of-bounds writes. No details of the vulnerability are provided at this time...

Scout security vulnerabilities

Scout is an open source platform from Clinical Genomics for analyzing VCFs and being able to aid collaborations to solve rare diseases faster. A security vulnerability exists in Scout versions prior to 4.89 that stems from a lack of filename cleanup and can bypass expected file extensions and all...