CVE-2024-2913 Race Condition Vulnerability in mintplex-labs/anything-llm

A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user...

CVE-2024-2913 Race Condition Vulnerability in mintplex-labs/anything-llm

A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user...

Vulnerabilities in employee management system could lead to remote code execution, login credential theft

Cisco Talos Vulnerability Research team has disclosed more than a dozen vulnerabilities over the past three weeks, five in a device that allows employees to check in and out of their shifts, and another that exists in an open-source library used in medical device imaging files. The Peplink Smart...

[SECURITY] Fedora 39 Update: unbound-1.19.3-1.fc39

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

[SECURITY] Fedora 38 Update: unbound-1.19.3-1.fc38

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

Fedora 39 : unbound (2024-3b173364d4)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3b173364d4 advisory. - Use the origin DNAME TTL for synthesized CNAMEs as per RFC 6672. - Bug fixes https://nlnetlabs.nl/projects/unbound/download/unbound-1-19-3 Tenable has...

Fedora 38 : unbound (2024-5bfa220621)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5bfa220621 advisory. - Use the origin DNAME TTL for synthesized CNAMEs as per RFC 6672. - Bug fixes https://nlnetlabs.nl/projects/unbound/download/unbound-1-19-3 Tenable has...

New 'Brokewell' Android Malware Spread Through Fake Browser Updates

Fake browser updates are being used to push a previously undocumented Android malware called Brokewell. "Brokewell is a typical modern banking malware equipped with both data-stealing and remote-control capabilities built into the malware," Dutch security firm ThreatFabric said in an analysis...

SiLabs Z-Wave over IP Gateway 安全漏洞

SiLabs Z-Wave over IP Gateway is a hardware unit that plugs into a Wi-Fi router and is used to add and configure Z-Wave devices as well as create and run "scenarios". A security vulnerability exists in SiLabs Z-Wave over IP Gateway v7.18.03 and earlier versions that exploits a denial of service D...

0G and OnePiece Labs Collaborate to Create Crypto x AI Incubator

By Owais Sultan 0G Labs and One Piece Labs have announced the launch of the first incubator for startups working at… This is a post from HackRead.com Read the original post: 0G and OnePiece Labs Collaborate to Create Crypto x AI Incubator...

[SECURITY] Fedora 40 Update: unbound-1.19.3-1.fc40

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

Silicon Labs Gecko Platform HTTP server header parsing invalid pointer dereference vulnerability

Talos Vulnerability Report TALOS-2024-1945 Silicon Labs Gecko Platform HTTP server header parsing invalid pointer dereference vulnerability April 18, 2024 CVE Number CVE-2023-51391 SUMMARY An invalid pointer dereference vulnerability exists in the HTTP server header parsing functionality of Silic...

@cremafinance/crema-sdk (>=2.0.11, <=2.0.14), @currie0612/crema-cli (>=0.0.12, <=0.0.42) +9 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.41.0, <=1.41.4)

@solana/web3.js NPM version =1.41.0, =2.0.11, =0.0.12, =2.0.11, =0.2.0-master.0, =1.0.3-beta.1, =1.2.2, =1.0.25, =1.0.1, =2.0.12, =1.0.0, =1.0.7 - winto-sdk 1.0.3 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@dynamic-labs/blocto-evm (>=0.19.0-alpha.21, <=2.1.0-alpha.0), @dynamic-labs/ethereum (>=0.17.0-RC.9, <=2.1.0-alpha.0) +19 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.70.1, <=1.70.3)

@solana/web3.js NPM version =1.70.1, =0.19.0-alpha.21, =0.17.0-RC.9, =2.0.0-alpha.31, =0.18.100-viem.1, =0.15.1-minimal.0, =2.0.0-alpha.4, =0.17.0-RC.7, =0.17.0-RC.7, =0.17.0-RC.10, =0.19.3, =0.19.0-alpha.13, =0.3.1-rc.c6e524e, =2.1.0, =0.1.18, =0.0.23, =0.0.28 and more Source cves: CVE-2024-3025...

CVE-2024-25911

Missing Authorization vulnerability in Skymoon Labs MoveTo.This issue affects MoveTo: from n/a through 6.2...

CVE-2024-25911 WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary File Deletion vulnerability

Missing Authorization vulnerability in Skymoon Labs MoveTo.This issue affects MoveTo: from n/a through 6.2...

CVE-2024-0549 Relative Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...

CVE-2024-3028 Improper Input Validation in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logofilename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the...

CVE-2024-3028 Improper Input Validation in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the 'logofilename' parameter in the 'system-preferences' API endpoint, an attacker can construct requests to read sensitive files or the...

CVE-2024-0404 Mass Assignment Vulnerability in mintplex-labs/anything-llm

A mass assignment vulnerability exists in the /api/invite/:code endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation process via an invitation link, an attacker...