CVE-2024-24494

Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, readbook, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components...

CVE-2024-24496

An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php components...

Malicious code in styled-compoment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16c83f145b667c0aea6b36d3009e7958a122f49e451f7e54d6c20e42437a72e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in styled-compoment

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Buffer overflow

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...

CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...

Vulnerabilities fixed in Google Android and Samsung Mobile

Google has fixed vulnerabilities in Android. A malicious person can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: Remote code execution Administrator/Root privileges Access to sensitive data Increased user privileges Successful misuse requires...

Ivanti Connect Secure Policy Secure Web Components

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure web components related to access control vulnerabilities. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to the level of an administrator...

Ivanti Connect Secure SAML Disclosure

The vulnerability of the SAML components in Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

Cross-Site Scripting (XSS)

dash-core-components are vulnerable to Cross Site Scripting XSS. The vulnerability is caused due to improper handling of the href attribute of the tag when the href attribute is controlled by an adversary. This allows an attacker to steal data that is visible to another user who opens a view...

Malicious code in ngpd-merceros-dynamic-forms-fe-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a63c636557949e167ac4cca437135be8c3160f70856ee5911c1817ba2c3f76a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ngpd-merceros-dynamic-forms-fe-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-964 Malicious code in ngpd-merceros-dynamic-forms-fe-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a63c636557949e167ac4cca437135be8c3160f70856ee5911c1817ba2c3f76a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-23054: Uncontrolled Search Path Element

An issue in Plone Docker Official Image 5.2.13 5221 open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index npm...

SUSE CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

magani (2020.2.0) potentially affected by CVE-2024-21485 via dash-core-components (1.4.0)

dash-core-components PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - magani 2020.2.0 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

divik (>=2.0.0b0, <=2.3.6) potentially affected by CVE-2024-21485 via dash-html-components (0.13.4)

dash-html-components PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - divik =2.0.0b0, =2.3.6 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

datadriver (>=0.1.0, <=0.1.3), ddui (3.0.4) potentially affected by CVE-2024-21485 via dash-html-components (0.13.5)

dash-html-components PYPI version 0.13.5 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - datadriver =0.1.0, =0.1.3 - ddui 3.0.4 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

tshistory-editor (>=0.2.0, <=0.4.0), tsview (>=0.2.0, <=0.2.1) potentially affected by CVE-2024-21485 via dash-html-components (0.10.0)

dash-html-components PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - tshistory-editor =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...

interpret (>=0.0.2, <=0.1.13) potentially affected by CVE-2024-21485 via dash-html-components (0.14.0)

dash-html-components PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - interpret =0.0.2, =0.1.13 Source cves: CVE-2024-21485 Source advisory: OSV:GHSA-547X-748V-VP6P...