Malicious code in Sоlnet.Extensioոs (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in MaterialDesignExtensions.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2803 Malicious code in operaextensions.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b9207a219bcb0da9f09f2b9c49edc832107607c624e5d9b3daa16b4c7fdf3d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mypy-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10ccf73f6507139e279e97b3fd9abef0395cd75b2f90dd18dde8e6f90753de4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mqttapplicationsamples/mqttjsclientextensions (npm)

--- -= Per source details. Do not edit below this line.=-...

Arbitrary Code Execution

typo3/cms is vulnerable to arbitrary file upload. The vulnerability is due to a missing file extensions in $GLOBALS'TYPO3CONFVARS''BE''fileDenyPattern', allowing backend users to upload executable files such as .phar, .shtml, .pl, or .cgi in certain web server setups...

CVE-2023-50029

PHP Injection vulnerability in the module "M4 PDF Extensions" m4pdf up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate method...

CVE-2023-50029

PHP Injection vulnerability in the module "M4 PDF Extensions" m4pdf up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate method...

PT-2024-13851 · Prestashop · Prestashop M4 Pdf Extensions Module

Name of the Vulnerable Software and Affected Versions: PrestaShop M4 PDF Extensions module versions up to 3.3.2 Description: The issue allows attackers to run arbitrary code via the M4PDF::saveTemplate method, potentially leading to code injection attacks. This could enable malicious activities,...

CVE-2023-50029

PHP Injection vulnerability in the module "M4 PDF Extensions" m4pdf up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate method...

CVE-2023-50029

CVE-2023-50029 affects PrestaShop’s M4 PDF Extensions (m4pdf) module up to version 3.3.2 by PrestaAddons. The vulnerability allows PHP injection through M4PDF::saveTemplate(), enabling arbitrary code execution. Documented impact is critical (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No expl...

Remote Code Execution via path traversal bypass in lollms

CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the ExtensionBuilder.buildextension function. The vulnerability arises from the /mountextension endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure...

CLSA-2024-1718898538 systemd: Fix of CVE-2023-7008

CVE-2023-7008: prevent systemd-resolved from accepting DNS records of DNSSEC- signed domains without a signature to mitigate man-in-the-middle attacks...

New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration

A new Rust-based information stealer malware called Fickle Stealer has been observed being delivered via multiple attack chains with the goal of harvesting sensitive information from compromised hosts. Fortinet FortiGuard Labs said it's aware of four different distribution methods -- namely VBA...

Cross-site Scripting (XSS)

TYPO3 is vulnerable to cross-site scripting XSS. The vulnerability is due to improper handling of t3:// URLs and typolink functionality, affecting both backend forms and frontend extensions that use typolink rendering...

OPENSUSE-SU-2024:10797-1 gnome-extensions-40.5-1.1 on GA media

These are all security issues fixed in the gnome-extensions-40.5-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13251-1 gnome-extensions-45.0-2.1 on GA media

These are all security issues fixed in the gnome-extensions-45.0-2.1 package on the GA media of openSUSE Tumbleweed...

Cross-site Scripting (XSS)

typo3/cms is vulnerable to cross-site scripting XSS. The vulnerability is due to improper handling of file extensions containing malicious sequences in the output table listing, which requires access to the server's file system either directly or through synchronization to exploit...

bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator

Processing specially crafted responses coming from DNSSEC-signed zones can lead to uncontrolled CPU usage, leading to a Denial of Service in the DNSSEC-validating resolver side. This vulnerability applies only for systems where DNSSEC validation is enabled...

bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

A flaw was found in bind9. By flooding a DNSSEC resolver with responses coming from a DNSEC-signed zone using NSEC3, an attacker can lead the targeted resolver to a CPU exhaustion, further leading to a Denial of Service on the targeted host. This vulnerability applies only for systems where DNSSE...