MAL-2025-27937 Malicious code in nv-localstore (npm)

The package nv-localstore was found to contain malicious code...

Malicious code in nv-localstore (npm)

The package nv-localstore was found to contain malicious code...

The vulnerability of the FileStore::LocalStore component in the Discourse mailing list management software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the FileStore::LocalStore component in the Discourse mailing list management software is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2024-53991

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore::LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

CVE-2024-53991 Potential Backup file leaked via Nginx in Discourse

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore::LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

CVE-2024-53991

Discourse backup file disclosure via default Nginx configuration (CVE-2024-53991) affects Discourse instances using FileStore::LocalStore for local uploads/backups. Attackers who know a backup filename can trick nginx into serving the backup file, exposing complete backups with sensitive data. Th...

CVE-2024-53991 Potential Backup file leaked via Nginx in Discourse

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore::LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

security flaw

The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file...