Cross-site Scripting (XSS)

Overview dash-html-components is a Vanilla HTML components for Dash. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the...

Cross-site Scripting (XSS)

Overview dash-core-components is a library that provides the core React component suite for Dash. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-html-components (2.0.0rc1)

dash-html-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory:...

PT-2024-18904

Name of the Vulnerable Software and Affected Versions dash-core-components versions prior to 2.13.0 dash versions prior to 2.15.0 dash-html-components versions prior to 2.0.16 Description The issue allows an authenticated attacker to steal data visible to another user who opens a view that exploi...

CVE-2024-21888

A privilege escalation vulnerability in web component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows a user to elevate privileges to that of an administrator...

Malicious code in diil-selfservice-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be3632254a6cd21edaffb63ace342ea00667ca30b7c8f9d01f929d76932adfb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-950 Malicious code in diil-selfservice-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be3632254a6cd21edaffb63ace342ea00667ca30b7c8f9d01f929d76932adfb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in diil-selfservice-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Command injection

OS command injection vulnerability in command processing or system call componentsROS2 Robot Operating System 2 Foxy Fitzroy, with ROSVERSION=2 and ROSPYTHONVERSION=3 allows attackers to run arbitrary commands...

Intel NUC Privilege Escalation

The vulnerability of Intel NUC’s built-in software is related to errors during the removal of special components. Exploiting this vulnerability can allow an attacker to increase their privileges...

Intel NUC Privilege Escalation

The vulnerability of Intel NUC’s built-in software is related to errors during the removal of special components. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2024-22638

liveSite v2019.1 was discovered to contain a remote code execution RCE vulenrabiity via the component /livesite/editdesignerregion.php or /livesite/addemailcampaign.php...

Deserialization of untrusted data

SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there i...

Oracle Patch Update, January 2024 Security Update Review

Oracle has released its first quarterly edition of Critical Patch Update, which contains patches for 389 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in a wide range of product families, includin...

CVE-2023-49515

Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components...

Ivanti Connect Secure Policy Secure Unauthorized Access

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure web components related to authentication procedures’ flaws. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by sending specially crafted requests...

CVE-2024-20934

...

CVE-2024-20908

...

Oracle Critical Patch Update Advisory - January 2024

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches add...

GHSA-8QW9-GF7W-42X5 Minor fix to previous patch for CVE-2022-35918

Impact The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific condition...