20112 matches found
CVE-2024-49774
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses tokengetall to par...
CVE-2024-50333
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...
CVE-2024-50333 RCE in ModuleBuilder in SuiteCRM
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...
CVE-2024-49774
Summary: CVE-2024-49774 affects SuiteCRM. The vulnerability stems from an incomplete blacklist-based check: SuiteCRM uses token_get_all to parse PHP scripts and compare the resulting AST against a blacklist, but this does not cover all scenarios, allowing bypasses. The issue has been addressed in...
CVE-2024-49774 ModuleScanner flaws in SuiteCRM
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses tokengetall to par...
Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages
An ongoing campaign is targeting npm developers with hundreds of typosquat versions of their legitimate counterparts in an attempt to trick them into running cross-platform malware. The attack is notable for utilizing Ethereum smart contracts for command-and-control C2 server address distribution...
Code-Projects E-Health Care System 安全漏洞
Code-Projects E-Health Care System is an open source e-health care system from Code-Projects. A security vulnerability exists in code-projects E-Health Care System version 1.0, which originates from an SQL injection in the parameter name/message...
Lylme Spage 安全漏洞
LyLme Spage Six Zero navigation page is China Six Zero LyLme open source a navigation page . Committed to simple and efficient advertising-free Internet navigation and search portal , support for background links , custom search engine , precipitation of the most valuable links , no commercial...
JATOS 安全漏洞
JATOS is an online learning tool from JATOS Open Source. A security vulnerability exists in JATOS version v3.9.3. An attacker exploiting the vulnerability could inject JavaScript into the description field...
PHPGurukul Hospital Management System 安全漏洞
PHPGurukul Hospital Management System is an open source PHP and MySQL based hospital management system from PHPGurukul. A security vulnerability exists in PHPGurukul Hospital Management System version 4.0, which stems from an incorrect manipulation of the parameter searchdata that can lead to...
1000 Projects Bookstore Management System 安全漏洞
1000 Projects Bookstore Management System is an open source bookstore management system from 1000 Projects. A security vulnerability exists in 1000 Projects Bookstore Management System version 1.0, which stems from an incorrect manipulation of parameter s that can lead to SQL injection...
Critical Flaws in Ollama AI Framework Could Enable DoS, Model Theft, and Poisoning
Cybersecurity researchers have disclosed six security flaws in the Ollama artificial intelligence AI framework that could be exploited by a malicious actor to perform various actions, including denial-of-service, model poisoning, and model theft. "Collectively, the vulnerabilities could allow an...
[SECURITY] Fedora 41 Update: chromium-130.0.6723.91-1.fc41
Chromium is an open-source web browser, powered by WebKit Blink...
[SECURITY] Fedora 40 Update: chromium-130.0.6723.91-1.fc40
Chromium is an open-source web browser, powered by WebKit Blink...
Appsmith 安全漏洞
Appsmith is an open source platform for building, deploying, and maintaining on-premise applications from Appsmith Open Source. A security vulnerability exists in Appsmith prior to version 1.46 that stems from the retrieval of AWS metadata credentials via cross-site request forgery...
Refit 注入漏洞
Refit is a library in the ReactiveUI open source. Refit suffers from an injection vulnerability that stems from failing to check for CRLF characters in the header value, making it vulnerable to server-side request forgery attacks...
Langflow 安全漏洞
Langflow is a visualization framework for building multi-agent and RAG applications from the Langflow open source. A security vulnerability exists in Langflow version 1.0.18 that stems from the inclusion of a remote code execution issue...
Malicious code in @toloka-tb/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c655dc69b310808896f252e5607b9dd8c4bd54b9d139caa655f5816f2269abd4 The OpenSSF Package Analysis project identified '@toloka-tb/core' @ 2.5.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in sc-meta-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e8afeccfd77a3b36e9c24aa1057807ba8f2a18972791b3cbc857e3d961e60d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
