CVE-2024-56828

File Upload vulnerability in ChestnutCMS through 1.5.0. Based on the code analysis, it was determined that the /api/member/avatar API endpoint receives a base64 string as input. This string is then passed to the memberService.uploadAvatarByBase64 method for processing. Within the service, the...

[SECURITY] Fedora 41 Update: radare2-5.9.8-4.fc41

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

MAL-2024-10697 Malicious code in code-analysis-shopee-ui-for-scf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8018baa56ec781ea13151a66ea8d0027c27ec76ea8fcc935bd8eff0e47343104 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in code-analysis-ts-for-sellercenter

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in code-analysis-shopee-ui-for-scf

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

[SECURITY] Fedora 40 Update: radare2-5.9.6-1.fc40

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 41 Update: radare2-5.9.6-1.fc41

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 39 Update: radare2-5.9.6-1.fc39

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

llvm-toolset:rhel8 bug fix and enhancement update

An update is available for llvm-compat, lld, compiler-rt, module.lld, lldb, python-lit, module.python-lit, module.lldb, llvm, libomp, module.compiler-rt, clang, module.libomp, module.llvm-compat, module.llvm, module.clang. This update affects Rocky Linux 8. A Common Vulnerability Scoring System...

CVE-2024-48540

Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48538

The Neye3C application (version v4.5.2.0 ) is vulnerable to incorrect access control within its firmware update and download processes. This flaw allows an attacker to access sensitive information by analyzing the code and data contained within the APK file . To mitigate this risk, users are reco...

OSV-2024-1200 UNKNOWN READ in eat_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372515100 Crash type: UNKNOWN READ Crash state: eatline extractfield parsesdpsession...

llvm-toolset:rhel8 bug fix and enhancement update

An update is available for lld, compiler-rt, module.lld, lldb, python-lit, module.python-lit, module.lldb, llvm, libomp, module.compiler-rt, clang, module.libomp, module.llvm, module.clang. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a...

[SECURITY] Fedora 40 Update: radare2-5.9.4-1.fc40

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

[SECURITY] Fedora 39 Update: radare2-5.9.4-1.fc39

The radare2 is a reverse-engineering framework that is multi-architecture, multi-platform, and highly scriptable. Radare2 provides a hexadecimal editor, wrapped I/O, file system support, debugger support, diffing between two functions or binaries, and code analysis at opcode, basic block, and...

This Week in Spring - June 18th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! I've just come from Paris, France, and now I'm in equally beautiful Krakow, Poland, for the amazing Devoxx PL event. We've got a ton of good stuff to dive into, so let's get going! In last week's installment of Spring Tips, I...

CVE-2024-4330 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the...

libssh security update

0.9.6-14 - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol BPP - Fix CVE-2023-6918 Missing checks for return values for digests - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection of malicious code through hostname - Note: version is bumped from 12 to 14...

CVE-2024-35902 net/rds: fix possible cp null dereference

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp-cpconn would produce null dereference Simon Horman adds: Analysis: cp is a parameter of rdsrdmamap and is not reassigned. The following call-sites pass a NULL...

Pentest-Muse-Cli - AI Assistant Tailored For Cybersecurity Professionals

Pentest Muse is an AI assistant tailored for cybersecurity professionals. It can help penetration testers brainstorm ideas, write payloads, analyze code, and perform reconnaissance. It can also take actions, execute command line codes, and iteratively solve complex tasks. Pentest Muse Web App In...