CVE-2024-45044 Bareos's negative command ACLs can be circumvented by abbreviating commands

Bareos is open source software for backup, archiving, and recovery of data for operating systems. When a command ACL is in place and a user executes a command in bconsole using an abbreviation i.e. "w" for "whoami" the ACL check did not apply to the full form i.e. "whoami" but to the abbreviated...

CVE-2024-40754

Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0...

CVE-2024-40754

Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0...

[SECURITY] Fedora 39 Update: firefox-130.0-3.fc39

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Number withdrawal

Nix is a powerful package manager from the Nix open source. It is used for making packages. This CVE number has been withdrawn...

Sunshine security vulnerabilities

Sunshine is a self-service game streaming host for Moonlight open-sourced by LizardByte. Sunshine suffers from a security vulnerability that stems from the possibility that a client that suffers a MITM attack during the pairing process may inadvertently allow access to unintended clients...

Google Android security vulnerabilities

Google Android is a Linux-based open source operating system from the American company Google. Google Android has a security vulnerability that stems from improper validation of input...

Computer Vision Annotation Tool security vulnerabilities

Computer Vision Annotation Tool CVAT is a cvat.ai open source interactive video and image annotation tool for computer vision. A security vulnerability exists in Computer Vision Annotation Tool CVAT versions prior to 2.18.0 that originates from an attacker with a CVAT account having access to any...

PT-2024-29028 · Samsung · Escargot

Name of the Vulnerable Software and Affected Versions: Escargot version 4.0.0 Description: The issue is a Heap-based Buffer Overflow vulnerability in the Samsung Open Source Escargot JavaScript engine, which allows overflow buffers to occur. This can potentially lead to security issues...

CVE-2024-40754: Heap-based Buffer Overflow

Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0...

CVE-2024-40643

Summary: CVE-2024-40643 affects Joplin via a parsing error that fails to properly handle “

USN-6995-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

OTRS Request Processing XSS

The vulnerability of the OTRS request processing system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

SQL Injection Vulnerability in Payroll Management System

Payroll Management System is itsourcecode open source payroll management system. Payroll Management System version 1.0 exists SQL injection vulnerability , the vulnerability stems from the file /ajax.php?action=deletedeductions parameter id will lead to SQL injection...

[SECURITY] Fedora 40 Update: firefox-130.0-3.fc40

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

GitHub Actions Vulnerable to Typosquatting, Exposing Developers to Hidden Malicious Code

Threat actors have long leveraged typosquatting as a means to trick unsuspecting users into visiting malicious websites or downloading booby-trapped software and packages. These attacks typically involve registering domains or packages with names slightly altered from their legitimate counterpart...

CVE-2024-45299 alf.io's preloaded data as json is not escaped correctly

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-115.15.0-i686-1slack15.0.txz: Upgraded. This release contains security fixes and improvements. For mo...

MAL-2024-8822 Malicious code in tappp-tv-ui-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b52ed9fb8d53c0432591a5d59422157e0340b1851686826a972f0ecd8fd1dbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45392 SuiteCRM has wrong deletion permission checks on API delete call

SuiteCRM is an open-source customer relationship management CRM system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue...