CVE-2023-45129

CVE-2023-45129 affects Synapse (Matrix homeserver). Before version 1.94.0, a malicious server ACL event can cause a (persistent) denial of service, impacting performance and reliability. Closed federation deployments are not affected. Mitigation: upgrade to Synapse 1.94.0 or later. As a workaroun...

CVE-2023-45129 matrix-synapse vulnerable to denial of service due to malicious server ACL events

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation which...

Malicious code in investing_parameters (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3fa4a6c4b0b94b2b009c0377390aeee029c2d9024af134c4697f3c8cdfb1f916 The OpenSSF Package Analysis project identified 'investingparameters' @ 1.2.1 rubygems as malicious. It is considered malicious because: - The...

Sirius - First Truly Open-Source General Purpose Vulnerability Scanner

Sirius is the first truly open-source general purpose vulnerability scanner. Today, the information security community remains the best and most expedient source for cybersecurity intelligence. The community itself regularly outperforms commercial vendors. This is the primary advantage Sirius Sca...

[SECURITY] Fedora 37 Update: firefox-118.0.1-7.fc37

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 37 Update: chromium-117.0.5938.149-1.fc37

Chromium is an open-source web browser, powered by WebKit Blink...

Matter Security Breach

Matter is a unified open source application layer connectivity standard designed to enable developers and device manufacturers to connect and build reliable, secure ecosystems and improve compatibility between connected home devices. Matter suffers from a security vulnerability that stems from a...

CVE-2023-42455 Wazuh vulnerable to user privilege escalation

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the AP...

Cross site scripting

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...

CVE-2023-44393 Piwigo Reflected XSS vulnerability

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...

CVE-2023-44393 Piwigo Reflected XSS vulnerability

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...

CVE-2023-44393

Piwigo vulnerabil ity CVE-2023-44393 affects the open‑source photo gallery Piwigo, prior to version 14.0.0beta4. The issue is a reflected XSS in the admin panel, triggered by the plugin_id parameter on the URL /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]. An attacker can lure...

Malicious code in cohort_sdk_js-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis abc50fadc1925fd27cf2d8f5e59cfe3992cf481db078f520b50ded4fc10f43c4 The OpenSSF Package Analysis project identified 'cohortsdkjs-darwin-x64' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

mojoPortal File Upload Vulnerability

mojoPortal is a cross-platform object-oriented web framework . A file upload vulnerability exists in mojoPortal, which can be exploited by a remote attacker to submit a special request that can upload malicious files and execute arbitrary code in the context of the application...

emlog pro /content/templates/arbitrary file upload vulnerability

emlog is a lightweight blog and CMS builder based on PHP and MySQL. An arbitrary file upload vulnerability exists in emlog pro /content/templates/, which can be exploited by a remote attacker to submit a special request that can be used to upload a malicious file to execute arbitrary code in the...

Linux Kernel eBPF Local Elevation of Privilege Vulnerability

Linux Kernel is an open source operating system. A security vulnerability exists in the Linux Kernel eBPF processing, which can be exploited by a local attacker to submit a special request that can elevate privileges...

Mozilla Firefox Process Created Twice Release Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox process creation suffers from a two-release vulnerability, which can be exploited by a remote attacker to submit a special Web request, tricking the user into parsing it, which can caus...

New OS Tool Tells You Who Has Access to What Data

Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential ...

[SECURITY] Fedora 38 Update: firefox-118.0.1-4.fc38

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Discourse Code Issue Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A security vulnerability exists in Discourse Discourse-jira, which originated from a vulnerability that allows an attacker to conduct a server request forgery SSRF attack by...