Sgxwallet 安全漏洞

Sgxwallet is an open source high-performance hardware-secured crypto wallet based on Intel Sgx technology. A security vulnerability exists in skalenetwork sgxwallet version v.1.9.0, which stems from a vulnerability that allows an attacker to cause a denial of service via the trustBlsSignMessage...

Apache Airflow Trust Management Issues Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow has a trust management issue vulnerability that stems from...

Freighter 信息泄露漏洞

Freighter is an extension to Stellar open source. An information disclosure vulnerability exists in Freighter 5.3.1 and earlier versions, which stems from a vulnerability that allows an attacker to access mnemonics via a private API using Javascript...

PT-2023-27078 · Unknown · Free/Open Source Inventory Management System

Name of the Vulnerable Software and Affected Versions: Free and Open Source Inventory Management System version 1.0 Description: A stored cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Add Expense parameter...

CVE-2023-41167

@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the...

Notepad++ 安全漏洞

Notepad++ is an open source plain text editor by Don Ho, an individual developer in Taiwan, China. A security vulnerability exists in Notepad++, which stems from a global buffer read overflow vulnerability in the nsCodingStateMachine::NextStater function...

FreeImage FreeImage_CloneTag Function Denial of Service Vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A denial of service vulnerability exists in the FreeImage FreeImageCloneTag function. An attacker can exploit this vulnerability to cause a denial of service...

Python 安全漏洞

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. Python has a security vulnerability that stems from the fact that the use of a socket can cause information leakag...

Keylime 安全漏洞

Keylime is an open source extensible trust system for Keylime that utilizes TPM technology. A security vulnerability exists in Keylime that stems from a vulnerability that could allow bypassing the Poll Response Protocol during agent registration...

CVE-2023-39707

CVE-2023-39707 concerns a stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0, allowing an attacker to inject arbitrary web scripts via the Add Expense field under Expense. The issue is tied to how input is handled in that parameter, enabling s...

KNX Connection Authorization 安全漏洞

KNX Connection Authorization is a network security product from KNX Open Source. KNX Connection Authorization suffers from a security vulnerability that stems from the fact that it is easy to be locked out and that users cannot reset them to gain access to the device...

Notepad++ 安全漏洞

Notepad++ is an open source plain text editor by Don Ho, an individual developer in Taiwan, China. A security vulnerability exists in Notepad++, which stems from a heap buffer write overflow vulnerability in the Utf816Read::convert function...

FreeImage load function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage load function that can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

Design/Logic Flaw

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue...

Server side request forgery (ssrf)

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint /proxy/?url= does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and...

CVE-2023-40017 Geonode Server Side Request Forgery vulnerability

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint /proxy/?url= does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and...

CVE-2023-40017

GeoNode versions 3.2.0–4.1.2 are affected by an SSRF vulnerability in the /proxy/?url= endpoint that enables port-scanning internal hosts and proxying data from internal services. Root cause is improper protection against SSRF. A patch is available at commit a9eebae80cb362009660a1fd49e105e7cdb499...

CVE-2023-39519

CVE-2023-39519 affects CloudExplorer Lite (open source cloud management platform). Prior to version 1.4.0, there is a vulnerability in how user information is retrieved that can lead to leakage of sensitive data. The issue has been fixed in version 1.4.0. Detailed entries across multiple sources ...

CVE-2023-39521

CVE-2023-39521 affects Tuleap, where content in the Kanban and PV2 apps’ card fields is not properly escaped. The issue can be triggered when an agile dashboard administrator deletes a kanban with a malicious label, potentially allowing uncontrolled code execution. Affected products/versions: Tul...

CVE-2023-37469

CVE-2023-37469 is a CasaOS Command Injection vulnerability that affects versions prior to 0.4.4. An authenticated CasaOS user who can connect to a controlled SMB server can execute arbitrary commands on the system. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity,...