CVE-2023-46236 FOG SSRF via unauthenticated endpoint(s)

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery SSRF vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote...

CVE-2023-46235

CVE-2023-46235 affects the FOG project prior to version 1.5.10.15, where a lack of request sanitization in log handling allows a malicious request containing XSS to be stored in a log file. When an administrator views the logs in the dashboard, the content is parsed as HTML, enabling XSS exposure...

CVE-2023-46235 FOG stored XSS on log screen via unsanitized request logging

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the log...

[SECURITY] Fedora 37 Update: slurm-22.05.10-1.fc37

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...

Cody, security breach.

Cody is a free open source AI coding assistant open sourced by Sourcegraph. It can write and fix code, provide AI-generated auto-completion, and answer coding questions. A security vulnerability exists in Cody versions 0.10.0 through 0.14.0 that stems from vulnerability to remote code execution...

Google Android Code Execution Vulnerability (CNVD-2024-05391)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code execution vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

Google Android Information Disclosure Vulnerability (CNVD-2024-05389)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Exim Security Vulnerabilities

Exim is an open source messaging agent MTA running on Unix systems that routes, forwards, and delivers mail. A security vulnerability exists in Exim that stems from Exim incorrectly processing user-supplied authentication data, resulting in memory corruption...

Apache Airflow Log Information Disclosure Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow has a log information leakage vulnerability , the vulnerability stem...

Google Android Information Disclosure Vulnerability (CNVD-2024-05387)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android Information Disclosure Vulnerability (CNVD-2024-05384)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android Information Disclosure Vulnerability (CNVD-2024-05390)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android Information Disclosure Vulnerability (CNVD-2024-05392)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android elevation of privilege vulnerability (CNVD-2024-05388)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability, which is caused by a privilege bypass in onCreate of ApnEditor.java. An attacker can exploit this vulnerability to gain elevated privileges...

Google Android elevation of privilege vulnerability (CNVD-2024-05386)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by attackers to gain elevated privileges...

Huawei EulerOS: Security Advisory for file (EulerOS-SA-2023-3027)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-45672

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at /confi...

CVE-2023-43798

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery SSRF. This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at httpclient.execute since the...

CVE-2023-45672 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at /confi...

CVE-2023-45671

Frigate is an open‑source network video recorder. Prior to version 0.13.0 Beta 3, a reflected cross‑site scripting (XSS) vulnerability exists in API endpoints that rely on the / base path; values in the URL are not sanitized, enabling arbitrary JavaScript execution when an authenticated user is t...