PYSEC-2024-21

A vulnerability classified as critical was found in vanderSchaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function loadfromfile of the component PKL File Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the...

PT-2024-15921 · Unknown · Van Der Schaar Lab Temporai

Name of the Vulnerable Software and Affected Versions: van der Schaar LAB TemporAI version 0.0.3 Description: A critical vulnerability was found in the function load from file of the component PKL File Handler, leading to deserialization. The attack can be launched remotely. The vendor was...

Malicious code in wlwz-2312-6107 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7495afd91e3ecba3ef1eede78227095124832a71cdc60e582ac4c233e4aa63fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-5406 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98f42b01ab31a06f273c8ac0dc5b11d2f9a0c2956dbfaa74cacd18d168a969f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-4003 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cade04019c93cac90303a5399259e82b8997c3c8f1a87492ac0b131a9086357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: exim

Issue Overview: Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but some...

It was discovered that when exec'ing from a non-leader thread armed POSIX CPU timers would be left on a list but freed leading to a use-after-free.

...

CVE-2024-23174

An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder,...

CVE-2023-49180

creationtimestamp| type| source ---|---|--- 2024-01-11 15:52:11+00:00| seen| https://t.me/ctinow/166577...

CVE-2023-6561

The Featured Image from URL FIFU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the featured image alt text in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Fedora 38 : exim (2024-e0841c83bb)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e0841c83bb advisory. Security fix for CVE-2023-51766. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Facebook Job Scam

Qualys has confirmed ongoing attacks against multiple brands offering work-from-home remote job offers, advertised through Facebook. Unfortunately, these scams typically see a rise in prevalence following the holidays. Qualys has confirmed cyber criminals are advertising jobs within Facebook to...

WWBN AVideo Security Breach

WWBN AVideo is a video platform builder written in PHP by the WWBN team. A security vulnerability exists in WWBN AVideo, which stems from a local file inclusion vulnerability in the getLanguageFromBrowser method...

CVE-2024-20681

creationtimestamp| type| source ---|---|--- 2024-01-09 20:16:20+00:00| seen| https://t.me/ctinow/165318 2025-05-03 02:16:45+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14675...

CVE-2023-49722

Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi network...

Request Smuggling

fastify-reply-from is vulnerable to Request Smuggling. The vulnerability is due to the absence of a unified Content-Type parsing, unlike the majority of Fastify that uses fast-content-type-parse with trimming after split. This issue can be exploited by an attacker to bypass security checks,...

CVE-2023-6042

Any unauthenticated user may send e-mail from the site with any title or content to the admin...

AZL-33498 CVE-2022-2585 affecting package kernel for versions less than 5.15.153.1-1

It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free...

@fastify/reply-from JSON Content-Type parsing confusion

Impact The main repo of fastify use fast-content-type-parse to parse request Content-Type, which will trim after split. The fastify-reply-from have not use this repo to unify the parse of Content-Type, which won't trim. As a result, a reverse proxy server built with @fastify/reply-from could...

CVE-2023-51701 @fastify-reply-from JSON Content-Type parsing confusion

fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with @fastify/reply-from could misinterpret the incoming body by passing an header ContentType: application/json ; charset=utf-8. This can lead to bypass of security checks...