CVE-2024-5083 Nexus Repository 2 - Stored XSS

A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1...

CVE-2024-5083

A stored cross-site scripting vulnerability affects Sonatype Nexus Repository 2 (OSS/Pro) up to and including version 2.15.1. Public descriptions indicate the issue is a stored XSS flaw in Nexus Repository 2 and that remediation involves updating to a version that includes the fix (as noted by PT...

CVE-2024-5083 Nexus Repository 2 - Stored XSS

A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1...

CLSA-2024-1731523206 Fix CVE(s): CVE-2024-32021

SECURITY UPDATE: Fix race condition when hardlinking file from the source repository into the destination file in the target repository. - debian/patches/CVE-2024-32021.patch: builtin/clone: abort when hardlinked source and target file differ - CVE-2024-32021...

Sonatype Nexus Repository 代码注入漏洞

Sonatype Nexus Repository is a repository manager from Sonatype, Inc. that is used for managing, storing, and distributing software, among other things. A code injection vulnerability exists in Sonatype Nexus Repository version 2.15.1 and earlier, which stems from the presence of a remote code...

Sonatype Nexus Repository Manager 跨站脚本漏洞

Sonatype Nexus Repository Manager NXRM is a repository manager from Sonatype, Inc. that is used for managing, storing, and distributing software, among other things. A cross-site scripting vulnerability exists in Sonatype Nexus Repository Manager version 2.15.1 and earlier, which stems from the...

MLflow < 2.9.2 Path Traversal Vulnerability

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 Tenable, Inc. include'compat.inc'; if description scriptid210769;...

Exploit for Out-of-bounds Write in Exim

CVE-2023-42115: Exploit and Payload Generator Scripts This r...

GHSA-88H5-6W7M-5W56 jj vulnerable to path traversal via crafted Git repositories

Impact Specially crafted Git repositories can cause jj to write files outside the clone. Patches Fixed in 0.23.0. Workarounds Not much other than to not clone repositories from untrusted sources. References Here's the original report from @joernchen: When cloning a crafted Git repository it is...

Jujutsu 路径遍历漏洞

Jujutsu is a powerful version control system for software projects from the individual developer Martin von Zweigbergk. A path traversal vulnerability previously existed in Jujutsu version 0.23.0, which stems from the fact that a specially crafted Git repository could cause jj to write files...

CLSA-2024-1730919636 Fix CVE(s): CVE-2024-32021

SECURITY UPDATE: Race condition when hardlinking file from the source repository into the destination file in the target repository. - debian/patches/CVE-2024-32021.patch: builtin/clone: abort when hardlinked source and target file differ - CVE-2024-32021...

MAL-2024-11591 Malicious code in fantasia3d (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f10f9afba1ef30b6953feb1080d6bb4df24f967023631cf9d577e974ddb3d412 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11563 Malicious code in control4d-multiview (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 321b180fa280d3e3b92106f3a20c69267ee789a4966b78905b1588d17552d935 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11730 Malicious code in torchs-visions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 55065e0cb0170fe8d242932d470508fb1013fa0cdba286b09bf8b239b3958533 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11614 Malicious code in imagedreamfusion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a6d6718a5b7231657a334b5a35b2053de510f4c15bdf137085121d29b5086121 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11580 Malicious code in dreamfusion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 daec888ce25f9bd9cea55776c72cf297d277b11e9dc13e4fa634dab5d11656e4 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in compressa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0cabf2172928d772d626ba857400e15f273fc925a9ff75e7f655ce461e9be498 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11543 Malicious code in bytebs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 443278bc9421868cfa1431a267241ecb62582b57285a1d5f093d7109e2d12288 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11731 Malicious code in torchvisions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 51134ba41129052e6c7163c273094867918aff7ffc9579a3834f3febb74b44d7 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11635 Malicious code in mnolith (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 207bbf082f73c1f6a049ee32f8cc0c74e31ea20c858caf879db53107132b9c4d A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...