File Upload Vulnerability in YouDianCMS (CNVD-2024-34730)

YouDianCMS is a domestic open source five-station outstanding solution. YouDianCMS has a file upload vulnerability that can be exploited by attackers to execute malicious php code to achieve remote code execution...

Number withdrawn

LibTIFF is a LibTIFF open source library for reading and writing TIFF Tagged Image File Format files. The library contains a number of command line tools for working with TIFF files. This CVE number has been withdrawn...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Malicious code in sap-at (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis af773cc64d0bc11506f1b43171d7266fb59e5a34603003653cbcc43f1ad02ffd The OpenSSF Package Analysis project identified 'sap-at' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicate...

Malicious code in sap-adv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5935ab744274c1707e0477f65c8639076dc9448a4add5aad7fe2466cf5ee14db The OpenSSF Package Analysis project identified 'sap-adv' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicat...

[SECURITY] Fedora 40 Update: onnx-1.14.1-3.fc40

onnx provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard data types...

Malicious code in sap-actionfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1ddc8179af4dd85a502b57776b8f45e5e370057c128851a174d17f16288db2de The OpenSSF Package Analysis project identified 'sap-actionfile' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

VNote Security Vulnerability

VNote is an open source cross-platform Markdown note-taking tool from VNote Open Source. A security vulnerability exists in VNote versions prior to 3.18.1, which stems from the presence of a code execution vulnerability that could allow an attacker to execute arbitrary programs on the victim's...

Number withdrawn

Bootstrap is an open source web front-end framework developed using HTML, CSS, and JavaScript by Bootstrap, Inc. This CVE number has been withdrawn...

ALSA-2024:4500 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 CVE-2024-6604 Mozilla: Race condition in permission assignment CVE-2024-6601...

CVE-2024-37148

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

UBUNTU-CVE-2024-37148

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37149 GLPI allows remote code execution through the plugin loader

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16...

CVE-2024-37149 GLPI allows remote code execution through the plugin loader

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16...

CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37147

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...

UBUNTU-CVE-2024-37147

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...

CVE-2024-37147 GLPI allows Authenticated File Upload to Restricted Tickets

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-firefox-115.13.0esr-i686-1slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more...

Security Bulletin: IBM Db2 and IBM WebSphere Application Server traditional used by IBM Security Verify Governance have multiple vulnerabilities

Summary IBM Security Verify Governance uses IBM Db2 and IBM WebSphere Application Server traditional as dependent components. Information about security vulnerabilities affecting these dependencies has been published in security bulletins. Vulnerability Details Refer to the security bulletins...