CVE-2024-52524 ReDoS in Giskard Scan text perturbation

Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution ReDoS vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential...

CVE-2024-52524 ReDoS in Giskard Scan text perturbation

Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution ReDoS vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential...

CVE-2024-40443

SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of service via the deleteusers function in the Useres.php...

MAL-2024-10604 Malicious code in @david-lab/evm-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da15cab58cbaaf01db60d8e67007017a770017bc33db5b17508dcd03db50b1a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[slackware-security] wget

New wget packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/wget-1.25.0-i586-1slack15.0.txz: Upgraded. Breaking change Drop support for shorthand FTP URLs CVE-2024-10524 Breaking change Switch to...

Devtron has SQL Injection in CreateUser API

Summary An authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. Details The API is CreateUser /orchestrator/user. The function to read user input is:...

GHSA-Q78V-CV36-8FXJ Devtron has SQL Injection in CreateUser API

Summary An authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. Details The API is CreateUser /orchestrator/user. The function to read user input is:...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient filtering of data. Note: This is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Pattern Lab. The package...

CVE-2024-43982

Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3...

CVE-2024-43982

Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3...

CVE-2024-43982

CVE-2024-43982 is a Missing Authorization vulnerability in WordPress plugin Login As Users (Geek Code Lab) affecting versions 1.4.3 and earlier. It enables Broken Access Control leading to account takeover. Remediation per PT-2024-30846: update to version 1.4.4 (or restrict plugin access as a tem...

Malicious Package

Overview artifact-lab-3-package-24ddbc49 is a malicious package. This package contains malicious code and was removed from the package manager. Remediation Avoid using all malicious instances of the artifact-lab-3-package-24ddbc49 package...

PT-2024-30846 · Geek Code · Geek Code Lab Login As Users

Name of the Vulnerable Software and Affected Versions: Geek Code Lab Login As Users versions 1.4.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can lead to unauthorized...

CVE-2024-51430

Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component...

SourceCodester Online Diagnostic Lab Management System 安全漏洞

SourceCodester Online Diagnostic Lab Management System is an online diagnostic lab management system from SourceCodester open source. A security vulnerability exists in SourceCodester Online Diagnostic Lab Management System version v.1.0. A remote attacker can exploit this vulnerability to execut...

CVE-2024-51430

CVE-2024-51430 is an XSS vulnerability in SourceCodester’s Online Diagnostic Lab Management System (PHP v1.0). The flaw allows a remote attacker to execute arbitrary code by manipulating the Test Name parameter in the diagnostic/add-test.php component. The affected item is the online diagnostic l...

CVE-2024-51430

Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component...

CVE-2024-51430

Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-128.4.0esr-i686-1slack15.0.txz: Upgraded. This release contains security fixes and improvements. For...

ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Credentials Disclosure

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller allows an unauthenticated attacker to...