IBM Security Verify Access security vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

CVE-2024-30262

Contao CVE-2024-30262: In versions prior to 4.13.40, when a frontend member changes their password (in Personal Data or Password Lost modules), associated remember-me tokens are not cleared, allowing ongoing access if a token was compromised. The issue is fixed in Contao 4.13.40. A recommended wo...

CVE-2024-28235

The CVE-2024-28235 entry concerns Contao (open-source CMS). Affected: Contao 4.9.0 up to 4.13.39 and 5.x up to 5.3.3. Root cause: when the crawler checks protected pages for broken links, the HTTP client options are applied to all requests, causing the cookie header to be sent to external URLs. I...

CVE-2024-28191 Contao may have unencoded insert tags in the frontend

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a...

CVE-2024-28190 Contao core bundle vulnerable to cross site scripting in the file manager

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files back end and front end, which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 an...

CVE-2024-28190 Contao core bundle vulnerable to cross site scripting in the file manager

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files back end and front end, which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 an...

PsiTransfer security vulnerabilities

PsiTransfer is a simple open source hosted file sharing solution from the individual developer Christoph Wiechert. A security vulnerability exists in PsiTransfer versions prior to 2.2.0, which stems from an unrestricted endpoint that allows an attacker who receives a file distribution ID to alter...

Apache HTTP Server Resource Management Error Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A resource management error vulnerability exists in Apache HTTP Server, which can be exploited by an attacker to cause memory...

Unifiedtransform security vulnerability

Unifiedtransform is an open source school management software from Sourceforge Open Source. It allows for comprehensive and efficient management of school operations. A security vulnerability exists in Unifiedtransform v2.X, which stems from vulnerability to stored cross-site scripting XSS attack...

DIRAC security vulnerabilities

DIRAC is an open source software framework for distributed computing from the DIRAC Project. A security vulnerability exists in DIRAC versions prior to 8.0.41, which stems from the possibility that an unauthorized user could gain read access to the agent, allowing the user to perform any action...

RedisBloom security vulnerability

RedisBloom is a library from the RedisBloom open source. Adds a set of probabilistic data structures to Redis. A security vulnerability exists in RedisBloom that stems from the possibility that an authenticated user may be able to perform a heap overflow using specially crafted commands, which...

CVE-2024-30269

Summary: DataEase before version 2.5.0 is vulnerable to a database configuration information exposure via the endpoint /de2api/engine/getEngine;.js. This path returns the platform’s database configuration, enabling disclosure of sensitive information. Affected versions: prior to 2.5.0 (e.g., up t...

QKSMS security vulnerabilities

QKSMS is an open source alternative to the Stock Messaging application on Android by Moez Bhatti Personal Developer. A security vulnerability exists in QKSMS 3.9.4 and earlier versions, which stems from a security flaw in the file androidmanifest.xml of the component Backup File Handler...

My Maintenance Policy

I wrote a short document describing how I maintain open source projects, to link it from my global CODEOFCONDUCT, CONTRIBUTING, and SECURITY files. It talks about how I prefer issues to PRs, how I work in batches, and how I'm trigger-happy with bans. It's all about setting expectations. It got so...

[SECURITY] Fedora 39 Update: chromium-123.0.6312.105-1.fc39

Chromium is an open-source web browser, powered by WebKit Blink...

Number withdrawal

PyMongo is an official MongoDB Python driver for MongoDB Open Source. This CVE number has been withdrawn...

Informational Bulletin: Impact of OSS CVEs in Prisma SD-WAN ION

The Palo Alto Networks Product Security Assurance team has evaluated the following open source software OSS CVEs as they relate to Prisma SD-WAN ION. While Prisma SD-WAN ION may include the affected OSS package, Prisma SD-WAN ION does not offer any scenarios required for an attacker to successful...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server

Summary IBM Db2 is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM Db2 have been published in a security bulletin CVE-2023-38729, CVE-2012-2677, CVE-2024-25030, CVE-2024-25046, CVE-2024-27254, CVE-2023-52296, CVE-2024-22360 Vulnerability Details...

Vulnerabilities Exposed Hugging Face to AI Supply Chain Attacks

By Deeba Ahmed Wiz.io, known for its cloud security expertise, and Hugging Face, a leader in open-source AI tools, are combining their knowledge to develop solutions that address these security concerns. This collaboration signifies a growing focus on securing the foundation of AI advancements...

RLSA-2024:1646 Important: grafana security and bug fix update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 Bug Fixes: TRIAGE CVE-2024-1394 grafana: golang-fips/openssl: Memory leaks i...