CVE-2024-43415 Decidim-Awesome: SQL injection in AdminAccountability

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidimawesome-module 0.9.0 allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands...

CVE-2024-43415 Decidim-Awesome: SQL injection in AdminAccountability

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidimawesome-module 0.9.0 allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands...

Unspecified Vulnerability in Mitel MiCollab

Mitel MiCollab is a mobile application from Mitel Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees. A security vulnerability exists in Mitel MiCollab, which can be exploited by remote attackers to elevate privileges and execute arbitrary comman...

Malicious code in oneui.angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bbff39f683b1b6c064ebc065aae50d8fd4123b1b53b7f90bed51db2d19562a6e The OpenSSF Package Analysis project identified 'oneui.angular' @ 99.99.99 npm as malicious. It is considered malicious because: - The package...

PT-2024-9377

Name of the Vulnerable Software and Affected Versions: CyberPanel versions through 2.3.6 and unpatched 2.3.7 Description: The issue is related to the upgrademysqlstatus function in CyberPanel, which has inadequate authentication procedures. This allows a remote attacker to bypass authentication a...

Malicious code in mcroutingservice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 15262556e3b11cafe3a148da26c5ca6a92e8ad98b01bf2f4c5deb6a26cdda697 The OpenSSF Package Analysis project identified 'mcroutingservice' @ 4.9.9 npm as malicious. It is considered malicious because: - The package...

MariaDB Code Injection Vulnerability

MariaDB is a free and open source database management system from the MariaDB Foundation and a forked version of MySQL with the Maria storage engine. A code injection vulnerability exists in MariaDB version 10.5, which stems from insecure privileges in the sysexec function and can be exploited by...

Synology Router Manager (SRM) 1.3.x Multiple Vulnerabilities (Synology-SA-24:16) - Unreliable Remote Version Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Malicious code in direct_access_theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e064b0aa00efc879c6095cc571b4d1359ef3cd9c13e1f02b5497c78d364fabef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

openSUSE Leap 操作系统命令注入漏洞

openSUSE Leap is a new openSUSE build and a new hybrid Linux distribution from SUSE Germany. An operating system command injection vulnerability exists in openSUSE Leap that stems from the presence of command injection, where an attacker can provide configuration to a service to allow execution o...

Malicious code in splunk-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3b4cb45a7c61ff4ef92918dc5438c1ae4845121a1c99903638fb56ffdbe8014 The OpenSSF Package Analysis project identified 'splunk-docs' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

CVE-2024-3506

CVE-2024-3506 corresponds to a buffer overflow in Milestone XProtect Device Pack camera drivers (Siveillance Video/XProtect Device Pack). Affected component is the camera driver within the Device Pack, with exploitation requiring access to an internal network and high attack complexity; CVSS show...

Malicious code in vault-assist-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8e6cabe2402b7271a427b21266f884d7992b70f29714ab10a32aaa2eb3c56a8d The OpenSSF Package Analysis project identified 'vault-assist-tool' @ 1.5.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in whatnot_seller_api_docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bd5f2c9e95b729435440515ed96f944e44f9be9e7843d90090aeef7a7a0716d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in djangosnippets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0bb7ea04063a1c85bc6858187976e5437ffa840e070088dd2b0c4406ebb728c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-6596

An unauthenticated remote attacker can run malicious c code included in curve files and execute commands in the users context...

CVE-2024-6596

CVE-2024-6596 concerns Endress+Hauser products (notably Echo Curve Viewer and related Curve functionality). The connected sources describe an unauthenticated remote attacker who can run malicious C# code contained in curve files and thereby execute commands in the user’s context, enabling remote ...

CVE-2024-6596 Endress+Hauser: Multiple products are vulnerable to code injection

An unauthenticated remote attacker can run malicious c code included in curve files and execute commands in the users context...

NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities: - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow...

PYSEC-2024-266

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...