[SECURITY] Fedora 40 Update: chromium-131.0.6778.139-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2024-54139 Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter

Combodo iTop is an open source and web-based IT service management platform. Prior to versions 2.7.11, 3.1.2, and 3.2.0., iTop has a cross-site scripting vulnerability that can lead to cross-site request forgery on the tableid parameter. Versions 2.7.11, 3.1.2, and 3.2.0 contain a patch for the...

[SECURITY] Fedora 41 Update: chromium-131.0.6778.139-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

JFinalCMS SQL Injection Vulnerability (CNVD-2024-49645)

JFinalCMS is an open source free JAVA enterprise website development and construction management system. JFinalCMS has a SQL injection vulnerability in version 1.0. The vulnerability is due to the failure to adequately validate and filter user-input data in the affected version, which can be...

CVE-2024-55888

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scriptin...

CVE-2024-55888 Content Security Policy appears to be missing in software and production setup

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scriptin...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities

Summary There are vulnerabilities in Open-Source Software OSS components consumed by IBM Cognos Dashboards on Cloud Pak for Data. Please refer to the Related Information section below for vulnerability impact. This Security Bulletin relates only to the direct usage of third-party components by IB...

1000 Projects Attendance Tracking Management System 注入漏洞

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. An injection vulnerability exists in 1000 Projects Attendance Tracking Management System version 1.0, which originates from the parameter adminusername in the file...

Apache Struts File Upload Vulnerability

Apache Struts is the United States Apache Apache Foundation, an open source project , is a set of open source MVC framework for creating enterprise-class Java Web applications , mainly provides two versions of the framework products , Struts 1 and Struts 2. Apache Struts has a file upload...

Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2024-2944)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PwnDoc 安全漏洞

PwnDoc is a penetration test report generator from PwnDoc open source. A security vulnerability exists in PwnDoc that stems from the ability for an attacker to write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on a system...

GLPI 访问控制错误漏洞

GLPI is an open source IT and asset management software from GLPI Open Source. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

A new version of Red Hat OpenShift distributed tracing platform Jaeger has been released Red Hat OpenShift distributed tracing platform based on Jaeger. Jaeger is a project inspired by Dapper and OpenZipkin. It is a distributed tracing system released as open source by Uber Technologies. It is us...

PwnDoc 安全漏洞

PwnDoc is a penetration test report generator from PwnDoc open source. A security vulnerability exists in PwnDoc. An attacker exploiting the vulnerability could read arbitrary files on the system...

Malicious code in @neo-ds/neo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6d3d5e2f6b432e3a4491b74a6c06d176dcf93aa9cf419db326cea281b530044b The OpenSSF Package Analysis project identified '@neo-ds/neo-utils' @ 3.3.7 npm as malicious. It is considered malicious because: - The package...

RAGFlow 安全漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A security vulnerability exists in RAGFlow version 0.13.0, which stems from improper access control of document-hooks.ts and allows unauthorized access to user documents...

Trix 跨站脚本漏洞

Trix is a Basecamp open source rich text editor for everyday writing. A cross-site scripting vulnerability exists in Trix versions prior to 2.1.9 and prior to 1.3.3. The vulnerability stems from the susceptibility to cross-site scripting attacks when malicious code is pasted, which may result in...

Motoko 安全漏洞

Motoko is a secure, simple, participant-based programming language open-sourced by DFINITY for building Internet Computer ICP jar smart contracts. Motoko has a security vulnerability that stems from the incremental garbage collector containing an uninitialized memory access error...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software from Sourceforge Open Source. It allows for comprehensive and efficient management of school operations. A security vulnerability exists in Unifiedtransform version 2.0 and prior versions, which stems from multiple access control...

Malicious code in less-rhino (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e73bfd1ed2aa0b8489fb39ddfc1ac2272730be0a23c877efe7ac2042216feb49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...