[SECURITY] Fedora 39 Update: mbedtls-2.28.7-1.fc39

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

Caddy Security Breach

Caddy is an open source, cross-platform HTTP/Web server from Caddy, Inc. Caddy suffers from a security vulnerability that stems from improperly limiting excessive authentication attempts for two-factor authentication 2FA...

alf.io Code Issues Vulnerabilities

alf.io is open source ticket reservation system. A code issue vulnerability exists in versions prior to Alf.io 2.0-M4-2402 that stems from the presence of a cross-site scripting XSS vulnerability...

YetiForceCrm Security Vulnerability

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A security vulnerability exists in YetiForce YetiForceCRM 6.4.0 and earlier versions, which originates from a vulnerability that allows an authenticated, remote attacker to obtain sensitive information via the license...

Design/Logic Flaw

MSS Mission Support System is an open source package designed for planning atmospheric research flights. In file: index.py, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The filena...

CVE-2024-25123 Path Manipulation in file mslib/index.py in MSS

MSS Mission Support System is an open source package designed for planning atmospheric research flights. In file: index.py, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The filena...

CVE-2024-25123

MSS (Mission Support System) contains a path manipulation vulnerability in mslib/index.py where the filename route parameter can include ../, enabling reading of files outside the intended directory. This affects MSS prior to version 8.3.3; upgrade to 8.3.3 to mitigate. The issue is caused by how...

GHSA-264G-F7V8-Q5QQ Magento Open Source allows Cross-Site Scripting (XSS)

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse...

GHSA-525F-PVJ5-VQMQ Magento Open Source allows OS Command Injection

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user...

Joomla Security Breach

Joomla is an open source, cross-platform content management system CMS developed by the Open Source Matters team using PHP and MySQL. A security vulnerability exists in Joomla DPCalendar that stems from the presence of a cross-site scripting XSS vulnerability...

CVE-2024-24259

A memory leak flaw was found in the glutAddMenuEntry function of freeglut, an open-source alternative to the OpenGL Utility Toolkit. This issue may allow an attacker to launch a denial of service attack by crashing or hanging the program or take advantage of other unexpected program behavior...

CVE-2024-25617

CVE-2024-25617 affects Squid, an open source web proxy/cache. The issue is a DoS in HTTP header parsing caused by a Collapse of Data into Unsafe Value, triggered by oversized headers. The vulnerability is exploitable via normal HTTP headers and is applicable to Squid versions prior to 6.5, where ...

DEBIAN-CVE-2024-24989

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3...

DEBIAN-CVE-2024-24990

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3...

CVE-2024-25125

Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload automation system is susceptible to a path traversal vulnerability if it's configured to store log files locally. This issue may lead to...

[SECURITY] Fedora 38 Update: firecracker-1.6.0-6.fc38

Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services that provide serverless operational models. Firecracker runs workloads in lightweight virtual machines, called microVMs, which combine...

CVE-2024-25125

CVE-2024-25125 affects Treasure Data’s Digdag workload automation system when configured to store log files locally, introducing a path traversal vulnerability that could disclose sensitive information. The issue is addressed in Digdag release 0.10.5.1; upgrade to that version to remediate. Publi...

Task Manager SQL Injection Vulnerability

Task Manager is a Code-Projects open source task manager application . Task Manager v1.0 SQL injection vulnerability , the vulnerability stems from the file / TaskManager / EditTask.php SQL injection vulnerability...

Task Manager Cross-Site Scripting Vulnerability

Task Manager is an open source task manager application from Code-Projects. Task Manager suffers from a cross-site scripting vulnerability that originates from a cross-site scripting XSS vulnerability in the file /TaskManager/Projects.php...

Grafana Security Vulnerabilities

Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus. Grafana has a security vulnerability that stems from inadequate cleanup of path parameters provided by...