WindMill security vulnerabilities

WindMill is a free and open source tool from the individual developer Lukasavicus. It is used to control job execution in Python. A security vulnerability exists in WindMill version 1.380.0 that stems from an improper restriction of excessive authentication attempts...

Informational Bulletin: Impact of OSS CVEs in PAN-OS

The Palo Alto Networks Product Security Assurance team has evaluated the following open source software OSS CVEs as they relate to PAN-OS software. While PAN-OS software may include the affected OSS package, PAN-OS does not offer any scenarios required for an attacker to successfully exploit thes...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-39480)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by attackers to bypass security restrictions...

CVE-2024-45620

A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accesse...

AZL-48757 CVE-2024-45619 affecting package opensc for versions less than 0.26.1-1

A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer...

UBUNTU-CVE-2024-45618

A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/seamonkey-2.53.19-i686-1slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more information, see:...

Malicious code in mhnumjp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 371f7362253fbbd65f7a86aac45e8363e35760789892d19b77a4a09ee4d76ecf The OpenSSF Package Analysis project identified 'mhnumjp' @ 1.999.1 npm as malicious. It is considered malicious because: - The package...

CVE-2024-45306

A heap-buffer overflow was found in Vim. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. It was assumed that this loop was...

SudoBot security vulnerability

SudoBot is an open source Discord audit bot from OneSoftNet. A security vulnerability exists in versions of SudoBot prior to 9.26.7 that stems from improper privilege control of the -config command, which could allow an unauthorized user to update any of the robot's configurations and gain contro...

SeaCMS security vulnerabilities

SeaCMS is a free, open source web content management system written in PHP by SeaCMS. The system has been designed primarily to manage video-on-demand resources. SeaCMS suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary web script or HTML v...

NGINX Plus/OSS Module Heap Overflow DoS

The vulnerability of the ngxhttpv4module in NGINX Plus and NGINX OSS web servers is related to reading data from outside of the memory boundaries. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2024-45306 heap-buffer-overflow in Vim

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop ...

CVE-2024-43801 Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin

Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin Web UI e.g. via "view image" in a...

Malicious npm Packages Mimicking 'noblox.js' Compromise Roblox Developers' Systems

Roblox developers are the target of a persistent campaign that seeks to compromise systems through bogus npm packages, once again underscoring how threat actors continue to exploit the trust in the open-source ecosystem to deliver malware. "By mimicking the popular 'noblox.js' library, attackers...

Overleaf security vulnerabilities

Overleaf is an open source online real-time collaborative LaTeX editor from Overleaf Open Source. A security vulnerability exists in Overleaf that stems from an insecure configuration of the LaTeX compiler by default...

Hoverfly security vulnerabilities

Hoverfly is a lightweight open source API emulation tool open-sourced by SpectoLabs. A security vulnerability exists in Hoverfly versions prior to v1.10.3. An attacker exploiting the vulnerability could read arbitrary files from the server...

Connaisseur security vulnerabilities

Connaisseur is an open source access controller from Secure Systems Engineering that integrates container image signature verification into Kubernetes clusters. A security vulnerability exists in Connaisseur version 3.3.0 and prior versions, which stems from an incorrect operation that can lead t...

Probate back office injection vulnerability

Probate Back Office is an open source tool from HM Courts & Tribunals Service. An injection vulnerability exists in Probate Back Office c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31 and prior versions, which stems from an unknown function in the Markdown Handler component and could lead to an injectio...

Android Open Source Platform (AOSP) Browser UXSS

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Open Source Platform AOSP Browser UXSS', 'Description' = %q This module exploits a Universal Cross-Site Scripting UXSS vulnerability...