CVE-2024-29031

CVE-2024-29031 documents a SQL injection in Meshery (github.com/layer5io/meshery) affecting GetMeshSyncResources via the order parameter, prior to version 0.7.17. The root cause is improper input handling that could disclose sensitive information. The issue is mitigated by upgrading to version 0....

CVE-2024-28116

Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection SSTI, which allows any authenticated user editor permissions are sufficient to execute arbitrary code on the remote server bypassing the existing securit...

CVE-2024-28118 Grav vulnerable to Server Side Template Injection (SSTI)

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages ca...

Gradio 跨站请求伪造漏洞

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. Gradio suffers from a cross-site request forgery vulnerability that stems from vulnerability to cross-site request forgery attacks...

Deno 安全漏洞

Deno is open source a simple , modern and secure JavaScript and TypeScript runtime environment . It uses V8 and is built with Rust. A security vulnerability exists in Deno versions 1.32.1 through 1.41, which originated from a vulnerability that allows an attacker to display a deceptive permission...

crmeb_java 安全漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A security vulnerability exists in versions prior to crmebjava v1.3.4, which stems from the presence of a SQL injection vulnerability that allows an attacker to run arbitrary SQL...

CVE-2024-23819

GeoServer has a stored Cross-Site Scripting (XSS) vulnerability in the MapML HTML Page. An authenticated administrator with workspace‑level privileges can store a JavaScript payload in the GeoServer catalog, which executes in another user’s browser when the MapML HTML Page is viewed. The MapML ex...

CVE-2024-23643

GeoServer contains a stored XSS vulnerability (CVE-2024-23643) in the GWC Seed Form. A authenticated administrator with workspace-level privileges can store a JavaScript payload in the GeoServer catalog, which then executes in another administrator’s browser when the GWC Seed Form is viewed. Affe...

CVE-2024-23642

GeoServer stores a Stored Cross-Site Scripting (XSS) vulnerability in the Simple SVG Renderer. The issue affects versions prior to 2.23.4 and 2.24.1, where an authenticated administrator with workspace‑level privileges can store a JavaScript payload in the GeoServer catalog that executes in anoth...

CVE-2024-23640

GeoServer stores a stored XSS vulnerability in Style Publisher. Authenticated administrators with workspace-level privileges can inject a JavaScript payload into uploaded style/legend resources or crafted datastore files, which will execute in the context of another user’s browser when viewed in ...

CVE-2024-23634

CVE-2024-23634 (GeoServer) affects GeoServer versions prior to 2.23.5 and 2.24.2. An authenticated administrator with REST Coverage/Data Store API file-store permissions can rename arbitrary files/directories to names not ending in .zip. External uploads are particularly susceptible, risking deni...

CVE-2023-51445

GeoServer’s CVE-2023-51445 is a stored XSS in the REST Resources API. Affected versions prior to 2.23.3 and 2.24.0 allow an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources, which will execute in another administrator’s b...

CVE-2023-41877

GeoServer path traversal vulnerability (CVE-2023-41877) affects GeoServer 2.23.4 and earlier. The issue requires GeoServer Administrator access to misconfigure the Global Settings for log file location, enabling an attacker to view logs via the GeoServer Logs page. The core impact includes potent...

CVE-2024-28570

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 r1909 allows a local attacker to cause a denial of service DoS via the processMakerNote function when reading images in JPEG format...

CVE-2024-28577

Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 r1909 allows a local attacker to cause a denial of service DoS via the jpegreadexifprofileraw function when reading images in JPEG format...

CVE-2024-28564

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 r1909 allows a local attacker to cause a denial of service DoS via the Imf22::CharPtrIO::readChars function when reading images in EXR format...

CVE-2024-28576

Buffer Overflow vulnerability in open source FreeImage v.3.19.0 r1909 allows a local attacker to cause a denial of service DoS via the opjj2ktcpdestroy function when reading images in J2K format...

[SECURITY] Fedora 39 Update: firefox-124.0-1.fc39

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 38 Update: firefox-124.0-1.fc38

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-115.9.0-i686-1slack15.0.txz: Upgraded. This release contains security fixes and improvements. For mor...