Malicious code in richcolor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50d5904bd379a75fd43115d7339df3d79f87ec691026774160b15b8632a9f8ae Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Linux kernel denial of service vulnerability (CNVD-2024-1476840)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a denial of service vulnerability that originates from the presence of a null pointer dereference in the function ath10kwmitlvoppullmgmttxcomplev. An...

Apache Airflow Security Bypass Vulnerability (CNVD-2024-0101425)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.8.0,...

Malicious code in discord.js-self-v21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7ff51b0a254299fbcba44e692ad912d759a48d835ffcb10759424392b1debdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 38 Update: chromium-120.0.6099.129-1.fc38

Chromium is an open-source web browser, powered by WebKit Blink...

GLSA-202312-11 : SABnzbd: Remote Code Execution

The remote host is affected by the vulnerability described in GLSA-202312-11 SABnzbd: Remote Code Execution - SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the...

W3c Spell Checker Cross-Site Scripting Vulnerability

W3c Spell Checker is an online spell checker open source by the World Wide Web Consortium. A cross-site scripting vulnerability exists in W3c Spell Checker version 20140130 and prior versions, which originates from a vulnerability that could lead to cross-site scripting...

CVE-2023-51449

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...

CVE-2023-51387

Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be some simple expressions. However, due to improper sanitization for alert expressions in version prior to 1.4.1, a malicious user can use a...

CVE-2023-51650

CVE-2023-51650 affects Hertzbeat prior to version 1.4.1, due to Spring Boot permission configuration issues that enable unauthorized access to three interfaces and may disclose sensitive server information. The issue is fixed in v1.4.1. No exploitation details are provided in the available docume...

CVE-2023-51387

CVE-2023-51387 affects Hertzbeat before v1.4.1, where improper sanitization of alert expressions in the aviatorscript evaluation path allows a user with access to the alert define function to execute arbitrary commands on the Hertzbeat server. The root cause is input sanitization in alert express...

Design/Logic Flaw

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an...

CVE-2023-50250 Cross-Site Scripting vulnerability when Import xml template file

Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in templatesimport.php...

CVE-2023-49791 Workflows do not require password confirmation on API level

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an...

CVE-2023-48704

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on...

CVE-2022-39337

CVE-2022-39337 affects Hertzbeat, a real-time monitoring system. The vulnerability is a permission bypass in versions up to 1.20, allowing bypass of system authentication and invocation of interfaces without authorization. The issue’s root cause is implied to be improper access control in older r...

[SECURITY] Fedora 38 Update: firefox-121.0-2.fc38

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 39 Update: firefox-121.0-2.fc39

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

MatrixSSL Security Vulnerability

Inside Secure MatrixSSL is an embedded, open-source SSLv3 stack designed for small applications and devices from Inside Secure, France. A security vulnerability exists in Rambus TLS Toolkit, MatrixSSL versions 4.x through 4.6.0, which stems from a length-subtracting integer overflow in the parsin...

Hertzbeat Security Vulnerabilities

Hertzbeat is an open source real-time monitoring system from the dromara organization. A security vulnerability exists in Hertzbeat version 1.20 and earlier versions, which stems from the ability to bypass privilege authentication...