7966 matches found
CVE-2024-5936 Open Redirect in imartinez/privategpt
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerabili...
CVE-2024-5936 Open Redirect in imartinez/privategpt
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerabili...
CVE-2024-5936 Open Redirect in imartinez/privategpt
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerabili...
Johnson Controls Illustra Essentials Gen 4 (Update A)
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Johnson Controls, Inc. Equipment : Illustra Essentials Gen 4 Vulnerability : Insertion of Sensitive Information into Log File 2. RISK EVALUATION Successful exploitation of this vulnerability...
Debian dsa-5721 : ffmpeg - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5721 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5721-1 [email protected] https://www.debian.org/securit...
Malicious code in sparkk (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2320 Malicious code in eslint-config-distribution (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in eslint-config-distribution (npm)
--- -= Per source details. Do not edit below this line.=-...
[SECURITY] [DSA 5715-2] composer regression update
------------------------------------------------------------------------- Debian Security Advisory DSA-5715-2 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 24, 2024 https://www.debian.org/security/faq -...
New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration
A new Rust-based information stealer malware called Fickle Stealer has been observed being delivered via multiple attack chains with the goal of harvesting sensitive information from compromised hosts. Fortinet FortiGuard Labs said it's aware of four different distribution methods -- namely VBA...
OPENSUSE-SU-2024:12706-1 amanda-3.5.2-3.1 on GA media
These are all security issues fixed in the amanda-3.5.2-3.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:12926-1 distribution-registry-2.8.2-1.1 on GA media
These are all security issues fixed in the distribution-registry-2.8.2-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:10723-1 docker-distribution-registry-2.7.1-7.2 on GA media
These are all security issues fixed in the docker-distribution-registry-2.7.1-7.2 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:12135-1 distribution-registry-2.8.1-1.1 on GA media
These are all security issues fixed in the distribution-registry-2.8.1-1.1 package on the GA media of openSUSE Tumbleweed...
OESA-2024-1715 libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...
Cybercriminals Employ PhantomLoader to Distribute SSLoad Malware
The nascent malware known as SSLoad is being delivered by means of a previously undocumented loader called PhantomLoader, according to findings from cybersecurity firm Intezer. "The loader is added to a legitimate DLL, usually EDR or AV products, by binary patching the file and employing...
ROS-20240611-09
A vulnerability in the BIND DNS server is related to a flaw in the use of assert. Exploitation vulnerability could allow an attacker acting remotely to cause a denial of service via the named parameter during DNS64 and serve-stale interaction A vulnerability in the named component of the DNS BIND...
Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing
Impact In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of Moby Docker Engine prior to 20.10.11 treat the Content-Type...
freeipa: delegation rules allow a proxy service to impersonate any user to access another target service
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the checkallowedtodelegate function: If the target service...