GHSA-9MX6-4GG4-85XJ Magento Open Source has Improper Input Validation Vulnerability

Adobe Commerce versions 2.4.7-beta1 and earlier, 2.4.6-p2 and earlier, 2.4.5-p4 and earlier and 2.4.4-p5 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authenticated attacker. Exploitation of this issue do...

[SECURITY] Fedora 38 Update: mbedtls-2.28.5-1.fc38

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

PortlandLabs Concrete CMS Arbitrary File Upload Vulnerability

PortlandLabs Concrete CMS is a team-oriented open source content management system of the United States PortlandLabs company . An arbitrary file upload vulnerability exists in PortlandLabs Concrete CMS version v9.2.1, which stems from the application's lack of effective validation of uploaded...

Exploit for CVE-2023-38646

CVE-2023-38646 PoC Description This is a Proof of Concept...

Using Velociraptor for large-scale endpoint visibility and rapid threat hunting

TL;DR Network-wide collection, acquisition and monitoring tool for use in DFIR engagements Designed for enterprise networks 150k+ Deployments aren’t unheard of Boasts many features that your commercial EDR has, and a few more Flexible querying language that can adapt to new threats and encourages...

onpremises Cross-Site Scripting Vulnerability

onpremises is an open source application from Structurizr. A cross-site scripting vulnerability exists in versions prior to onpremises 3194. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

Zabbix Security Vulnerabilities

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in Zabbix that stems from a security flaw in the Proxy, Server component that allows an attacker with...

CVE-2023-43661

Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch...

Design/Logic Flaw

Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch...

CVE-2023-43661

CVE-2023-43661 (Cachet) affects Cachet prior to the 2.4 branch, where the template functionality could let an attacker execute code on the server due to inadequate input filtration and an old Twig version. The issue is mitigated by a patch in the 2.4 branch (commit 6fb043e109d2a262ce3974e863c54e9...

Linux kernel resource management error vulnerability (CNVD-2024-08091)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a resource management error vulnerability that originates from a confusion in the instructions responsible for freeing memory in the fs/smb/client...

CVE-2023-45129

CVE-2023-45129 affects Synapse (Matrix homeserver). Before version 1.94.0, a malicious server ACL event can cause a (persistent) denial of service, impacting performance and reliability. Closed federation deployments are not affected. Mitigation: upgrade to Synapse 1.94.0 or later. As a workaroun...

CVE-2023-45129 matrix-synapse vulnerable to denial of service due to malicious server ACL events

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers running on a closed federation which...

Malicious code in investing_parameters (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3fa4a6c4b0b94b2b009c0377390aeee029c2d9024af134c4697f3c8cdfb1f916 The OpenSSF Package Analysis project identified 'investingparameters' @ 1.2.1 rubygems as malicious. It is considered malicious because: - The...

Sirius - First Truly Open-Source General Purpose Vulnerability Scanner

Sirius is the first truly open-source general purpose vulnerability scanner. Today, the information security community remains the best and most expedient source for cybersecurity intelligence. The community itself regularly outperforms commercial vendors. This is the primary advantage Sirius Sca...

[SECURITY] Fedora 37 Update: firefox-118.0.1-7.fc37

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 37 Update: chromium-117.0.5938.149-1.fc37

Chromium is an open-source web browser, powered by WebKit Blink...

Matter Security Breach

Matter is a unified open source application layer connectivity standard designed to enable developers and device manufacturers to connect and build reliable, secure ecosystems and improve compatibility between connected home devices. Matter suffers from a security vulnerability that stems from a...

CVE-2023-42455 Wazuh vulnerable to user privilege escalation

Wazuh is a security detection, visibility, and compliance open source project. In versions 4.4.0 and 4.4.1, it is possible to get the Wazuh API administrator key used by the Dashboard using the browser development tools. This allows a logged user to the dashboard to become administrator of the AP...

Cross site scripting

Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting XSS vulnerability is in the /admin.php?page=plugins&tab=new&installstatus=ok&pluginid=here page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS co...