CVE-2024-45611 GLPI has a stored XSS at src/RSSFeed.php

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload t...

CVE-2024-45610 GLPI has a reflected XSS in ajax/cable.php

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Cable form...

CVE-2024-51494 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when editing a device's port settings. This vulnerability...

Malicious code in libnpmpublishing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 000ac1f9e3e24873823d90fa6c4785583e0f65c86d7c26847dd8819079f1e6e7 The OpenSSF Package Analysis project identified 'libnpmpublishing' @ 99.3.5 npm as malicious. It is considered malicious because: - The package...

OSV-2024-1311 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=378836879 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange java.base/java.lang.StringUTF16.newString java.base/java.lang.StringBuilder.toString...

1000 Projects Beauty Parlour Management System 注入漏洞

1000 Projects Beauty Parlour Management System is an open source beauty parlor management system from 1000 Projects. An injection vulnerability exists in version 1.0 of 1000 Projects Beauty Parlour Management System, which stems from the parameter email in the file /admin/forgot-password.php that...

ZhongBangKeJi CRMEB 安全漏洞

ZhongBangKeJi CRMEB is an open source e-commerce management system from ZhongBangKeJi China. A security vulnerability exists in ZhongBangKeJi CRMEB version 5.4.0 and earlier versions, which stems from an access control error...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that stems from Nextcloud Tables allowing users to create tables with separate columns...

Google Android elevation of privilege vulnerability (CNVD-2024-49502)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges...

Sylius 安全漏洞

Sylius is a suite of open source e-commerce platforms based on the Symfony framework by the Polish company Sylius. A security vulnerability exists in Sylius. An attacker exploiting the vulnerability could execute malicious scripts in a user's browser...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud that originates from a malicious user being able to send an incorrectly formatted login link that redirects th...

Google Android Information Disclosure Vulnerability (CNVD-2024-47704)

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

FlightPath 安全漏洞

FlightPath is an open source academic advising system for universities from FlightPath, Inc. A security vulnerability exists in FlightPath version 7.5. An attacker can exploit this vulnerability to inject arbitrary JavaScript into a user's web browser...

Budget Control Gateway 授权问题漏洞

Budget Control Gateway is a gateway component of the Budget Control application from BudgetControl open source. An authorization issue vulnerability exists in Budget Control Gateway versions prior to 1.2 that stems from failure to properly validate authentication tokens, allowing an attacker to...

Google Android Denial of Service Vulnerability (CNVD-2024-47703)

Google Android is a Linux-based open source operating system from Google. A denial of service vulnerability exists in Google Android, which can be exploited by attackers to cause a denial of service...

Google Android Code Injection Vulnerability (CNVD-2026-11745)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code injection vulnerability that stems from a lack of privilege checking. The vulnerability can be exploited by an attacker to elevate privileges...

LibreNMS 跨站脚本漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. LibreNMS suffers from a cross-site scripting vulnerability that stems from a stored...

CVE-2024-40579

Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modification of the hostname parameter...

Malicious code in wixdevpoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 233144e1f7875e1d1028b6101f34a5191e04312b9190d4be6ebcd51fee02c497 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-9476

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizatio...