Malicious code in jquery-ui-smoothness (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbde2167eb940c597861a429b583a7e45ac7225bee0da328cc03ddbbcb363beb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-8456: Missing Authentication for Critical Function

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices...

WordPress Full frame Theme <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Full frame Type Theme Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44010 Patch priority Low CVSS severity Low 5.1 Developer Claim ownership PSID e76845de4c18 Credits Michael Required privilege Author Published ...

PLANET switch devices 访问控制错误漏洞

PLANET switch devices are a series of switch devices from PLANET Corporation in China. An access control error vulnerability exists in PLANET switch devices, which stems from a lack of proper access control for the firmware upload and download functions, allowing an unauthenticated, remote attack...

Malicious code in site-national-covoiturage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8365d5692c3d8076f268afad156f7548908a668a49d837af327fadfd645a4175 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alertsorchestration-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad590e8c8853e4883c2994808bae19870b1d76002b74c084b196e7e4ebcf6cea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-6983 Remote Code Execution in mudler/localai

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

CVE-2024-6983 Remote Code Execution in mudler/localai

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

CVE-2024-6983

CVE-2024-6983 affects mudler/localai v2.17.1. The backend accepts inputs beyond the configuration file, enabling an attacker to upload a binary and execute code, potentially gaining full system control. Public reports in connected sources confirm this RCE vector and cite the vulnerable version as...

CVE-2024-6983 Remote Code Execution in mudler/localai

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

Malicious code in assistants-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49dcd943b6b43273aa613aed19e623aa2ae67153ce323248811b64b441f38364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Critical NVIDIA Container Toolkit Vulnerability Could Grant Full Host Access to Attackers

A critical security flaw has been disclosed in the NVIDIA Container Toolkit that, if successfully exploited, could allow threat actors to break out of the confines of a container and gain full access to the underlying host. The vulnerability, tracked as CVE-2024-0132, carries a CVSS score of 9.0...

MAL-2024-9013 Malicious code in multiple-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da4233e3b39779d62d23e578c4ceb25ff5a78a6f0285b709b91ef0cf36ed7d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in poolpairs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebb978ca1e587144e4ad0da4ddd79f512a198c09e643e88ff1e2274927820b29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-6983: Improper Control of Generation of Code

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

ROS-20240927-06

A vulnerability in the VideoBridge component of Mozilla Firefox, Firefox ESR and Thunderbird email client browsers is related to errors in security settings. Exploitation of the vulnerability could allow an attacker, acting remotely, to bypass the protection mechanism of an isolated software...

CVE-2024-7781

CVE-2024-7781 concerns Jupiter X Core for WordPress. The records show an authentication bypass in all versions up to and including 4.7.5, enabling unauthenticated attackers to log in as the first user who logged in via a social media account (potentially an admin). The vulnerability can be exploi...

Malicious code in dx-shared-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 606308070423ea9552fa204ea73e727dd3081035515bcc41c3d56fc3a18a1abe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

goTenna Pro ATAK Plugin 安全漏洞

The goTenna Pro ATAK Plugin is a plugin for goTenna's device that creates networks for off-grid communication and situational awareness. A security vulnerability exists in goTenna Pro ATAK Plugin version 1.9.12 and earlier, which stems from an encryption key being stored on the device along with ...

CVE-2024-47169: Path Traversal: '.../...//'

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those...