20658 matches found
CVE-2024-36402 Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo
Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then...
CVE-2024-36402 Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo
Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then...
CVE-2024-36402
CVE-2024-36402 affects Matrix Media Repo (MMR) prior to 1.3.5. Unauthenticated remote participants could trigger remote media download/cache into the local media repo, making content available for unauthenticated download and enabling planting problematic content. The issue is partially mitigated...
matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content
Impact MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated wa...
GHSA-8VMR-H7H5-CQHG matrix-media-repo (MMR) allows unauthenticated writes to the media repository, which may allow planting of problematic content
Impact MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated wa...
The vulnerability of the rsync repository of the FORT verifier, related to uncontrolled resource consumption, allows attackers to increase their privileges.
The vulnerability of the rsync repository in the FORT verifier is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...
PT-2025-2448 · Unknown +1 · Matrix Media Repo +1
Name of the Vulnerable Software and Affected Versions: Matrix Media Repo versions prior to 1.3.5 Description: The issue allows unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. This makes the content...
Lazarus Group Targets Web3 Developers with Fake LinkedIn Profiles in Operation 99
The North Korea-linked Lazarus Group has been attributed to a new cyber attack campaign dubbed Operation 99 that targeted software developers looking for freelance Web3 and cryptocurrency work to deliver malware. "The campaign begins with fake recruiters, posing on platforms like LinkedIn, luring...
CVE-2024-46901
A flaw was found in Apache Subversion when serving repositories via moddavsvn. This issue may allow authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository via insufficient validation of filenames against control characters...
DependencyCheck
Repository Moved The...
GitHub Desktop 安全漏洞
GitHub Desktop is a GitHub desktop version of GitHub Desktop open source. A security vulnerability exists in GitHub Desktop versions prior to 3.4.12, which stems from an attacker inducing a user to clone a repository, either directly or through a submodule, which could allow an attacker to access...
CVE-2024-50338 Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager
Git Credential Manager GCM is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format key=value. Git's documentation restricts the...
CVE-2024-50338 Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager
Git Credential Manager GCM is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format key=value. Git's documentation restricts the...
MAL-2025-2942 Malicious code in awsglueml (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8a7eb55169fa28d500f750382641170b6a921f1ebca4e715a10d33b05ff78f8b This is a couple of packages with names appearing to be a library for an AWS or other service. Their only behaviour is to call home on installation or import -...
MAL-2025-2941 Malicious code in awsgluedq (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 da16cd67a3672f17d5cce10c5626cf682be33e63db5ca04db645b975afc9bea1 This is a couple of packages with names appearing to be a library for an AWS or other service. Their only behaviour is to call home on installation or import -...
GO-2025-3384 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
Path Traversal
github.com/charmbracelet/soft-serve is vulnerable to a Path Traversal. The vulnerability is due to improper handling of user-supplied input in the path traversal mechanism, allows non-admin users to access and modify repositories that should be restricted to others...
PT-2025-3149 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS Description: A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptibl...
