[SECURITY] Fedora 40 Update: chromium-131.0.6778.108-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

Mozilla Firefox: Multiple Vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Asterisk: Multiple Vulnerabilities

Background Asterisk is an open source telephony engine and toolkit. Description Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

CVE-2024-54136 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to...

Researchers Uncover Flaws in Popular Open-Source Machine Learning Frameworks

Cybersecurity researchers have disclosed multiple security flaws impacting open-source machine learning ML tools and frameworks such as MLflow, H2O, PyTorch, and MLeap that could pave the way for code execution. The vulnerabilities, discovered by JFrog, are part of a broader collection of 22...

Malicious code in asuuuuu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 40d2219a3e70e5af240f63d41ab082cad543b84acf2abd045011db292bc69654 The OpenSSF Package Analysis project identified 'asuuuuu' @ 3.1.3 npm as malicious. It is considered malicious because: - The package communicat...

Snyk Code Agent 安全漏洞

Snyk Code Agent is an agent from Snyk open source. A security vulnerability exists in Snyk Code Agent. An attacker exploiting this vulnerability could execute arbitrary code inside the Code Agent container...

Apache NimBLE Buffer Overflow Vulnerability

Apache NimBLE is an open source Bluetooth 5.4 stack host and controller from the Apache Foundation, USA, that completely replaces the proprietary SoftDevice on Nordic chipsets.It is part of the Apache Mynewt project. Apache NimBLE suffers from a buffer overflow vulnerability that can be exploited...

1000 Projects Library Management System 安全漏洞

1000 Projects Library Management System is an open source library management system from 1000 Projects. A security vulnerability exists in 1000 Projects Library Management System version 1.0 due to an SQL injection in the parameter useri...

1000 Projects Beauty Parlour Management System 注入漏洞

1000 Projects Beauty Parlour Management System is an open source beauty parlor management system from 1000 Projects. An injection vulnerability exists in 1000 Projects Beauty Parlour Management System version 1.0, which is caused by an SQL injection in the parameter name...

Code-Projects Simple CRUD Functionality 代码注入漏洞

Code-Projects Simple CRUD Functionality is a Code-Projects open source web application. Code-Projects Simple CRUD Functionality version 1.0 suffers from a code injection vulnerability that stems from the vulnerability to cross-site scripting attacks via the newtitle/newdescr parameter...

path-to-regexp 安全漏洞

Path-to-RegExp is an open source tool from pillarjs. It is used to convert path strings to regular expressions. A security vulnerability exists in versions prior to path-to-regexp 0.1.12. An attacker exploiting this vulnerability can cause poor performance...

1000 Projects Library Management System 安全漏洞

1000 Projects Library Management System is an open source library management system from 1000 Projects. A security vulnerability exists in 1000 Projects Library Management System version 1.0 due to a SQL injection in parameter q. The vulnerability is caused by the presence of a parameter q in the...

Malicious code in private-lib-bug-bounty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef8c8e73b8b4d3414d06cadfd08f308a41276fe31204d26bc85d1eb566c4923c The OpenSSF Package Analysis project identified 'private-lib-bug-bounty' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in vue-midata (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc06ec1e2eb7c0a1bd2a27e81568ad8ee48c80f63b74284118e768a9740222e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Moderate: Red Hat Bug Fix Advisory: Updated rhel9/firefox-flatpak container image

An updated rhel9/firefox-flatpak container image is now available in the Red Hat container registry. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Flatpak is a system for running graphical applications as containers. Installing an...

Horilla 代码问题漏洞

Horilla is a free and open source human resources software from Horilla, Inc. A code issue vulnerability exists in Horilla 1.2.1 and prior versions that stems from the presence of a deserialization vulnerability...

Mattermost Input Validation Error Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an input validation error vulnerability that stems from failing to properly validate an email address, no details of the vulnerability are provided at this time...

Multiple Mozilla Product Spoofing Vulnerabilities (CNVD-2025-00860)

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A spoofing vulnerability exists in several Mozilla products. An attacker...

CVE-2024-37303 Synapse unauthenticated writes to the media repository allow planting of problematic content

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the...