CVE-2024-21630 Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to

Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite...

Malicious code in uui-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20e448a4d82eef5d5f76dd3f8c325358b3b2df9e1d124b28a4a2843f466cb94a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 39 Update: firefox-122.0-1.fc39

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

CVE-2024-23055

An issue in Plone Docker Official Image 5.2.13 5221 open-source software allows for remote code execution via improper validation of input by the HOST headers...

Fedora: Security Advisory (FEDORA-2024-14dea9640b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The Unknown Risks of The Software Supply Chain: A Deep-Dive

In a world where more & more organizations are adopting open-source components as foundational blocks in their application's infrastructure, it's difficult to consider traditional SCAs as complete protection mechanisms against open-source threats. Using open-source libraries saves tons of coding...

Kanboard Security Breach

Kanboard is a suite of open source visual task board software. The software has the ability to customize the panels according to the business. A security vulnerability exists in Kanboard version 1.2.34 that stems from vulnerability to HTML injection attacks...

PYSEC-2024-126

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

Cross site scripting

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-firefox-115.7.0esr-i686-1slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more...

Malicious NPM Packages Exfiltrate Hundreds of Developer SSH Keys via GitHub

Two malicious packages discovered on the npm package registry have been found to leverage GitHub to store Base64-encrypted SSH keys stolen from developer systems on which they were installed. The modules named warbeast2000 and kodiak2k were published at the start of the month, attracting 412 and...

Linux has a binary vulnerability

Linux is an open source Unix-like operating system. Linux has a binary vulnerability that can be exploited by attackers to elevate privileges...

Malicious code in froxlor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 445e6f97a516e090b04dc5969fbc1472e2c740461dec0b7769bbe76e5d3b6326 The OpenSSF Package Analysis project identified 'froxlor' @ 19.0.4 npm as malicious. It is considered malicious because: - The package...

[slackware-security] tigervnc

New tigervnc packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/tigervnc/tigervnc-1.12.0-i586-5slack15.0.txz: Rebuilt. Recompiled against xorg-server-1.20.14, including the latest patches for several securit...

PaddlePaddle Security Vulnerabilities

PaddlePaddle Flying Paddle is an independent R&D deep learning platform open-sourced by China Flying Paddle PaddlePaddle. PaddlePaddle has a security vulnerability that stems from the presence of a command injection vulnerability...

CVE-2024-23329

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch//history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party...

Design/Logic Flaw

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch//history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party...

Critical “PixieFail” Flaws Expose Millions of Devices to Cyberattacks

By Deeba Ahmed Quarkslab Discovers "PixieFail" Vulnerabilities: Critical Flaws in Open Source UEFI Code Require Immediate Patching. This is a post from HackRead.com Read the original post: Critical "PixieFail" Flaws Expose Millions of Devices to Cyberattacks...

Npm Trojan Bypasses UAC, Installs AnyDesk with "Oscompatible" Package

A malicious package uploaded to the npm registry has been found deploying a sophisticated remote access trojan on compromised Windows machines. The package, named "oscompatible," was published on January 9, 2024, attracting a total of 380 downloads before it was taken down. oscompatible included ...

[SECURITY] Fedora 38 Update: espeak-ng-1.51.1-6.fc38

The eSpeak NG Next Generation Text-to-Speech program is an open source spee ch synthesizer that supports over 70 languages. It is based on the eSpeak engine created by Jonathan Duddington. It uses spectral formant synthesis by default which sounds robotic, but can be configured to use Klatt forma...