[SECURITY] Fedora 37 Update: firefox-118.0.1-7.fc37

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 37 Update: chromium-117.0.5938.149-1.fc37

Chromium is an open-source web browser, powered by WebKit Blink...

Matter Security Breach

Matter is a unified open source application layer connectivity standard designed to enable developers and device manufacturers to connect and build reliable, secure ecosystems and improve compatibility between connected home devices. Matter suffers from a security vulnerability that stems from a...

CVE-2023-42455 Wazuh vulnerable to user privilege escalation

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the AP...

Cross site scripting

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...

CVE-2023-44393 Piwigo Reflected XSS vulnerability

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...

CVE-2023-44393 Piwigo Reflected XSS vulnerability

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...

CVE-2023-44393

Piwigo vulnerabil ity CVE-2023-44393 affects the open‑source photo gallery Piwigo, prior to version 14.0.0beta4. The issue is a reflected XSS in the admin panel, triggered by the plugin_id parameter on the URL /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]. An attacker can lure...

Malicious code in cohort_sdk_js-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis abc50fadc1925fd27cf2d8f5e59cfe3992cf481db078f520b50ded4fc10f43c4 The OpenSSF Package Analysis project identified 'cohortsdkjs-darwin-x64' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

emlog pro /content/templates/arbitrary file upload vulnerability

emlog is a lightweight blog and CMS builder based on PHP and MySQL. An arbitrary file upload vulnerability exists in emlog pro /content/templates/, which can be exploited by a remote attacker to submit a special request that can be used to upload a malicious file to execute arbitrary code in the...

Linux Kernel eBPF Local Elevation of Privilege Vulnerability

Linux Kernel is an open source operating system. A security vulnerability exists in the Linux Kernel eBPF processing, which can be exploited by a local attacker to submit a special request that can elevate privileges...

Mozilla Firefox Process Created Twice Release Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox process creation suffers from a two-release vulnerability, which can be exploited by a remote attacker to submit a special Web request, tricking the user into parsing it, which can caus...

mojoPortal File Upload Vulnerability

mojoPortal is a cross-platform object-oriented web framework . A file upload vulnerability exists in mojoPortal, which can be exploited by a remote attacker to submit a special request that can upload malicious files and execute arbitrary code in the context of the application...

New OS Tool Tells You Who Has Access to What Data

Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential ...

[SECURITY] Fedora 38 Update: firefox-118.0.1-4.fc38

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Discourse Code Issue Vulnerability

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. A security vulnerability exists in Discourse Discourse-jira, which originated from a vulnerability that allows an attacker to conduct a server request forgery SSRF attack by...

[SECURITY] Fedora 39 Update: firefox-118.0.1-4.fc39

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

CVE-2023-43805

Nexkey (Misskey fork) pre-12.121.9 is vulnerable due to incomplete URL validation, allowing bypass of authentication for access to the job queue dashboard. The issue is fixed in version 12.121.9. As a workaround, operators have used access-blocking measures (e.g., WAF rules like Cloudflare) to mi...

CVE-2023-43793

Misskey before version 2023.9.0 is vulnerable: by editing the URL, an attacker can bypass authentication for the Bull dashboard (the job queue UI) and access it. The Red Hat, NVD, OSV, and other connected sources consistently describe this as an authentication bypass affecting Misskey prior to 20...

CVE-2023-44389 Zope management interface vulnerable to stored cross site scripting via the title property

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface ZMI. All versions of Zope 4 and Zope 5 are affected. Patches will be released wit...