GLPI Path Traversal Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

Jumpserver Path Traversal Vulnerability

Jumpserver is an open source bastion machine from China's Hangzhou Feizhiyun Information Technology Co. JumpServer suffers from a path traversal vulnerability that originates when a logged in user can access and modify the contents of any file on the system...

GLPI Information Leakage Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

Google libwebp open source library remote code execution vulnerability

WebP is an image format developed by Google, which supports lossy and lossless compression of network images, and its compression effect and speed have certain advantages over PNG and JPEG formats. libwebp is a C/C++ open source library that implements the coding and decoding of the WebP image...

Exim Security Vulnerabilities

Exim is an open source messaging agent MTA from Exim Open Source that runs on Unix systems and is responsible for routing, forwarding and delivering mail. Exim has a security vulnerability that stems from a lack of proper validation of user-supplied data...

Zephyr Security Breach

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in the Zephyr Bluetooth subsystem that stems from a buffer overflow issue...

GLPISQL Injection Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

Zephyr Security Breach

Zephyr is an extensible real-time operating system RTOS open-sourced by the Zephyr Project. A security vulnerability exists in Zephyr that stems from a buffer overflow issue...

CVE-2023-41878

MeterSphere’s CVE-2023-41878 describes a vulnerability in the Selenium VNC configuration where a weak default password allows unauthenticated access to VNC and can grant high-level privileges. Affected product: MeterSphere (Selenium VNC config). Root cause: default weak password enabling unauthor...

CVE-2023-41878 Weak password of selenium VNC in MeterSphere

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high...

CVE-2023-42453 Improper validation of receipts allows forged read receipts in matrix synapse

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event if they knew the room ID and event ID. Note that the users were not able to view the events, but simply mark it as read. This could be confusing as...

CVE-2023-42819

CVE-2023-42819 is a directory traversal vulnerability in JumpServer. Authenticated users can access and modify arbitrary files via the API endpoint /api/v1/ops/playbook/{playbook_id}/file/?key=../../../../../../../etc/passwd, enabling file disclosure (and potential modification) on affected syste...

CVE-2023-42819 Path traversal in Jumpserver

JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c38f-492d-bd92-832bacc3df5f'. An attacker ca...

CVE-2023-42820 Random seed leakage in Jumpserver

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

CVE-2023-43644

CVE-2023-43644 affects sing-box and enables an authentication bypass for all SOCKS5 inbounds with user authentication via specially crafted requests. The impact is an authentication bypass with potential high-severity consequences. Affected versions require updating to sing-box 1.4.4 or 1.5.0-rc....

The vulnerability of the software platforms for developing and managing Magento Open Source and Adobe Commerce stores relates to lack of access control. This allows attackers to circumvent existing security restrictions and enhance their privileges.

The vulnerability of the Magento Open Source and Adobe Commerce software platforms for developing and managing online stores is related to lack of access control mechanisms. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions and increase their...

Apache Airflow Authorization Problem Vulnerability (CNVD-2023-72233)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions prior to 2.7.1 have an authorization issue vulnerability th...

[SECURITY] Fedora 39 Update: firecracker-1.4.1-2.fc39

Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services that provide serverless operational models. Firecracker runs workloads in lightweight virtual machines, called microVMs, which combine...

Fedora: Security Advisory (FEDORA-2023-8e6ae98f81)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-42812 Galaxy vulnerable to Server Side Request Forgery during data imports

Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a...