CVE-2024-37303

CVE-2024-37303 concerns Synapse before version 1.106, where unauthenticated remote participants could trigger download and caching of remote media into the local media repository, making such content downloadable again from the local server unauthenticated. The underlying issue is an attack surfa...

CVE-2024-37303

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the...

CVE-2024-37303 Synapse unauthenticated writes to the media repository allow planting of problematic content

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the...

How to Update Location Profile Endpoint Details and Preserve Access to an Existing Kopia Storage Repository

Purpose This article documents the correct procedure to update the Endpoint details in the Location Profile for an existing Kopia storage repository in S3-compatible stores and ensure the existing associated repositories remain accessible. Customers may wish to update the Endpoint details e.g.,...

"Database connection settings for the Microsoft Entra ID backup repository cannot be found."

If you are encountering this error after recently upgrading to Veeam Backup & Replication 12.3, and that upgrade failed on the first attempt, and you attempted the upgrade a second time, please review the section discussing "For Customers Who Ran the Upgrade a Second Time and It Succeeded" on...

GO-2024-3296 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli

Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli...

CVE-2021-34630

creationtimestamp| type| source ---|---|--- 2024-12-02 11:23:41+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-34630.yaml...

MAL-2025-913 Malicious code in datagov-harvester (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd1508013c2ef9abe7de7e4eb3bbdc492b545c3344ae4148b4e06165e8313229 The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-998 Malicious code in trove4j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d9c0dbfcd94c11b086cf83f69796c321829bdd64c2ebe53d8f74a72d46e465b0 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

XML-RPC npm Library Turns Malicious, Steals Data, Deploys Crypto Miner

Cybersecurity researchers have discovered a software supply chain attack that has remained active for over a year on the npm package registry by starting off as an innocuous library and later adding malicious code to steal sensitive data and mine cryptocurrency on infected systems. The package,...

SUSE Manager 后置链接漏洞

SUSE Manager is a Linux server management system from SUSE Germany. The system provides automated software management, system configuration and monitoring. SUSE Manager suffers from a back-link vulnerability that originates from an attacker who is allowed to create a specially crafted git...

CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab

Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid excel / spreadsheet formula. When an instructor downloads their course's roster and opens, this name will then be evaluated as a formula. This...

CVE-2024-53260 Course Roster vulnerable to CSV Injection in Autolab

Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid excel / spreadsheet formula. When an instructor downloads their course's roster and opens, this name will then be evaluated as a formula. This...

CVE-2024-53858 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

GO-2024-3291 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs...

Exploit for Use of Hard-coded Credentials in Mariazevedo88 Travels-Java-Api

PoC Authentication Bypass MFA Really Simple Security WordPress...

MAL-2024-11078 Malicious code in repository-dispatch1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f9656fdbcf8cfe7b8793ea8ca6e482acdd0cd50039d7b14f2e00924b3b2d0e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in repository-dispatch1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f9656fdbcf8cfe7b8793ea8ca6e482acdd0cd50039d7b14f2e00924b3b2d0e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11077 Malicious code in repository-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6945fe41e15be899900e8df18381144d95f14a8645f686d9b4c96f755e46f8d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in repository-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6945fe41e15be899900e8df18381144d95f14a8645f686d9b4c96f755e46f8d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...