Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system for snipe individual developers. A security vulnerability exists in Snipe-IT version v.7.0.13. An attacker can exploit the vulnerability to elevate privileges...

KLA77111 ACE vulnerabilities in Microsoft Open Source Software

Remote code execution vulnerabilities were found in Microsoft Open Source Software. Malicious users can exploit these vulnerabilities to execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in TorchGeo can be exploited remotely to execute...

Element 安全漏洞

Element is a Matrix web collaboration client from Element Open Source. A security vulnerability exists in Element versions prior to 1.11.85, which originates from a malicious master server that sends invalid messages...

[slackware-security] wget

New wget packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/wget-1.25.0-i586-1slack15.0.txz: Upgraded. Breaking change Drop support for shorthand FTP URLs CVE-2024-10524 Breaking change Switch to...

Security Flaws in Popular ML Toolkits Enable Server Hijacks, Privilege Escalation

Cybersecurity researchers have uncovered nearly two dozen security flaws spanning 15 different machine learning ML related open-source projects. These comprise vulnerabilities discovered both on the server- and client-side, software supply chain security firm JFrog said in an analysis published...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from the cURL wrapper stripping the HTTPAUTH and USERPWD headers during...

USN-7099-1: OpenJDK 21 vulnerabilities

Andy Boothe discovered that the Networking component of OpenJDK 21 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. CVE-2024-21208 It was discovered that the Hotspot component of OpenJDK 21 did not...

Malicious code in careers-job-detail (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16052b4d2e03953110406185695adc84ab3af8481eb5790e4b4c0f1421bc1b9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LemonLDAP::NG 安全漏洞

LemonLDAP::NG is the LemonLDAP::NG open source suite of web single sign-on and access management software. A security vulnerability exists in LemonLDAP::NG versions prior to 2.0.12, which stems from a lack of expiration checking that does not validate the validity of access tokens, which could...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a null pointer dereference...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a null pointer dereference...

data.all 安全漏洞

data.all is an open source development framework from data-dot-all open source. A security vulnerability exists in data.all that stems from the fact that a member of the data.all management team with access to an AWS account owned by a customer deploying data.all may be able to extract user data...

Malicious code in deriv-app-id-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c03deb9ccf8f604f4e3ba191f6d8c2e3f94cc273950f13aafde768a468f13071 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AI Industry is Trying to Subvert the Definition of “Open Source AI”

The Open Source Initiative has published news article here its definition of "open source AI," and it's terrible. It allows for secret training data and mechanisms. It allows for development to be done in secret. Since for a neural network, the training data is the source code--it's how the model...

Malicious NPM Packages Target Roblox Users with Data-Stealing Malware

A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer malware such as Skuld and Blank-Grabber. "This incident highlights the alarming ease with which threat actors can launch supply chain attack...

Watcharr 安全漏洞

Watcharr is an open source, self-hosted watchlist for all content movies, TV shows, anime, games by sbondCo Open Source. A security vulnerability exists in Watcharr v1.43.0 and earlier versions, which stems from a weak JWT token being vulnerable. An attacker can exploit a crafted JWT token for...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2024-2918)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor.double-free in dialogchanged in Vim v9.1.0648.When abandoning a buffer, Vim may ask the user what to d...

Codezips Online Institute Management System 代码问题漏洞

Codezips Online Institute Management System is a Codezips open source online institute management system. A code issue vulnerability exists in Codezips Online Institute Management System version 1.0, which stems from the parameter websiteimage in the file /managewebsite.php that can lead to...

CVE-2024-47073

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

CVE-2024-51989 Cross-site Scripting (XSS) Vulnerability in PasswordPusher

Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting XSS vulnerability was identified in the PasswordPusher application, affecting versions v1.41.1 through and including v.1.48.0. The issue arises from an un-sanitized parameter...