CVE-2024-39721

An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely even after the HTTP request is aborted...

The vulnerability of Acronis Cyber Protect 16’s data protection software lies in its ability to bypass authentication by using a user-controlled key. This allows attackers to increase their privileges.

The vulnerability of Acronis Cyber Protect 16 data protection software lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

U.S. Government Issues New TLP Guidance for Cross-Sector Threat Intelligence Sharing

The U.S. government USG has issued new guidance governing the use of the Traffic Light Protocol TLP to handle threat intelligence information shared between the private sector, individual researchers, and Federal Departments and Agencies. "The USG follows TLP markings on cybersecurity information...

PT-2024-10218 · Schneider Electric · Schneider Electric Powerlogic Hdpm6000

Name of the Vulnerable Software and Affected Versions: Schneider Electric PowerLogic HDPM6000 version 0.62.7 Description: The issue is related to an authorization bypass vulnerability that could allow an authorized attacker to modify values outside those defined by their privileges, potentially...

CVE-2024-50483

Authorization Bypass Through User-Controlled Key vulnerability in Meetup allows Privilege Escalation.This issue affects Meetup: from n/a through 0.1...

CVE-2024-50483

Authorization Bypass Through User-Controlled Key vulnerability in Tareq Hasan Meetup meetup allows Privilege Escalation.This issue affects Meetup: from n/a through = 0.1...

CVE-2024-47880

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the export-rows command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page th...

UBUNTU-CVE-2024-47882

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an...

CVE-2024-47880 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the export-rows command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page th...

SUSE CVE-2024-9287

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means that...

Python Command Injection Vulnerability (Oct 2024) - Mac OS X

Python is prone to a command injection vulnerability in the venv module. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-46483

Xlight FTP Server 3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacker-controlled content...

UBUNTU-CVE-2024-9287

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means that...

CVE-2024-9287 Virtual environment (venv) activation scripts don't quote paths

A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts ie "source venv/bin/activate". This means that...

CVE-2024-46483

CVE-2024-46483 affects Xlight FTP Server versions prior to 3.9.4.3. The vulnerability is an integer overflow in the SFTP packet parsing logic, which can cause a heap overflow when processing attacker-controlled content. Related sources describe potential remote code execution consequences in affe...

CVE-2024-46483

Xlight FTP Server 3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacker-controlled content...

Exploit for Code Injection in Grafana

File-Read-CVE-2024-9264 Proof Of Concept for File Read in Graf...

MAL-2024-9423 Malicious code in ethers-eth (npm)

The package contains additional code to exfiltrate user private keys to an attack-controlled server...

MAL-2024-9425 Malicious code in ethers-web3 (npm)

The package contains additional code to append a hardcoded SSH key to the user's authorizedkeys file, creating a backoor, along with exfiltrating user private keys to an attack-controlled server...

MAL-2024-9422 Malicious code in ethers-aaa (npm)

The package contains additional code to exfiltrate user private keys to an attack-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 268e60b27602a9e78702588325e96f875b3d37da5815147256c8becfd3d97270 Any computer that has this package installed or...