The vulnerability of the `ff_mpeg4_decode_picture_header` function in the `libavcodec/mpeg4videodec.c` file of the FFmpeg multimedia library, related to pointer arithmetic errors, allows attackers to cause a denial-of-service attack.

The vulnerability of the ffmpeg4decodepictureheader function in the libavcodec/mpeg4videodec.c file of the FFmpeg multimedia library is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a service failure by using a specially created AVI file...

Malicious code in language-matlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c3bff0146045d9130d2bb2523e15b9f1e582a33f6ba1e2a33524ffe5bb05732 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in usss (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 252cdf6830dae64423e603510c0465768ef7d1134896697f352a8949c12d5c2c A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in huggingfaces-hub (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 030324e12766820002cc282dbac28f60bb0f2fc82d459e96c82f073a14e75592 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in importlibs-resource (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e5b18ca50565bbf39ba25d92703302ffabb63cb0a0d6fde1934437d016d4cc0c A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in easydicts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9206e6e8b697ab23f82a17cb169a867896f4f8469351b31cbb31f41bee662cee A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in shot2story (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b1cb3804872d11b7f51bfc5588086dcdf5d8b68905b353e7b619ce55bfdf28a0 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in hllm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c984c02970a9295543df7e945c9aa0ab34b1102216b42ef189fa6d626274a00a A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

[SECURITY] Fedora 40 Update: syncthing-1.28.0-1.fc40

Syncthing replaces other file synchronization services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it's transmitted over the Internet. Using syncthing, that control is...

HPESBGN04727 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM) Software, Multiple Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Denial of Service DoS; Remote: Arbitrary Code Execution, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC Prior to 3.1.10 CVSS Scores: | CVE | CVSS Vector | Base Score | |...

UnoPim 安全漏洞

UnoPim is an open source Product Information Management PIM system based on the Laravel framework by UnoPim Open Source. A security vulnerability exists in UnoPim 0.1.3 and earlier versions, which stems from a cross-site scripting XSS vulnerability in the Create User function that allows an...

PT-2024-7993 · F5 +1 · F5 Networks +1

Name of the Vulnerable Software and Affected Versions: NGINX OpenID Connect affected versions not specified F5 Networks affected versions not specified Description: A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login...

CVE-2024-49774

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses tokengetall to par...

CVE-2024-50333

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...

CVE-2024-50333 RCE in ModuleBuilder in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...

CVE-2024-49774

Summary: CVE-2024-49774 affects SuiteCRM. The vulnerability stems from an incomplete blacklist-based check: SuiteCRM uses token_get_all to parse PHP scripts and compare the resulting AST against a blacklist, but this does not cover all scenarios, allowing bypasses. The issue has been addressed in...

CVE-2024-49774 ModuleScanner flaws in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses tokengetall to par...

Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages

An ongoing campaign is targeting npm developers with hundreds of typosquat versions of their legitimate counterparts in an attempt to trick them into running cross-platform malware. The attack is notable for utilizing Ethereum smart contracts for command-and-control C2 server address distribution...

Code-Projects E-Health Care System 安全漏洞

Code-Projects E-Health Care System is an open source e-health care system from Code-Projects. A security vulnerability exists in code-projects E-Health Care System version 1.0, which originates from an SQL injection in the parameter name/message...

JATOS 安全漏洞

JATOS is an online learning tool from JATOS Open Source. A security vulnerability exists in JATOS version v3.9.3. An attacker exploiting the vulnerability could inject JavaScript into the description field...