Malicious code in deriv-app-id-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c03deb9ccf8f604f4e3ba191f6d8c2e3f94cc273950f13aafde768a468f13071 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AI Industry is Trying to Subvert the Definition of “Open Source AI”

The Open Source Initiative has published news article here its definition of "open source AI," and it's terrible. It allows for secret training data and mechanisms. It allows for development to be done in secret. Since for a neural network, the training data is the source code--it's how the model...

Malicious NPM Packages Target Roblox Users with Data-Stealing Malware

A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer malware such as Skuld and Blank-Grabber. "This incident highlights the alarming ease with which threat actors can launch supply chain attack...

Watcharr 安全漏洞

Watcharr is an open source, self-hosted watchlist for all content movies, TV shows, anime, games by sbondCo Open Source. A security vulnerability exists in Watcharr v1.43.0 and earlier versions, which stems from a weak JWT token being vulnerable. An attacker can exploit a crafted JWT token for...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2024-2918)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor.double-free in dialogchanged in Vim v9.1.0648.When abandoning a buffer, Vim may ask the user what to d...

Codezips Online Institute Management System 代码问题漏洞

Codezips Online Institute Management System is a Codezips open source online institute management system. A code issue vulnerability exists in Codezips Online Institute Management System version 1.0, which stems from the parameter websiteimage in the file /managewebsite.php that can lead to...

CVE-2024-47073

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

CVE-2024-51989 Cross-site Scripting (XSS) Vulnerability in PasswordPusher

Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting XSS vulnerability was identified in the PasswordPusher application, affecting versions v1.41.1 through and including v.1.48.0. The issue arises from an un-sanitized parameter...

Prompt Injection Defenses Against LLM Cyberattacks

Interesting research: "Hacking Back the AI-Hacker: Prompt Injection as a Defense Against LLM-driven Cyberattacks": Large language models LLMs are increasingly being harnessed to automate cyberattacks, making sophisticated exploits more accessible and scalable. In response, we propose a new defens...

BIT-SUITECRM-2024-49773 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. currentpost parameter in export entry point can be abused ...

BIT-SUITECRM-2024-49774 ModuleScanner flaws in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses tokengetall to par...

BIT-SUITECRM-2024-50333 RCE in ModuleBuilder in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels function can be used to write attacker-controlled data into the custom language file that will be includ...

[SECURITY] Fedora 39 Update: firefox-132.0-2.fc39

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that originates from bulk messaging of unauthenticated message recipients...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a security vulnerability that stems from the presence of a memory leak...

lunary SQL Injection Vulnerability

lunary is lunary open source a production toolkit for LLM . lunary suffers from a SQL injection vulnerability that stems from the use of sql.unsafe in the order by clause of a SQL query without prior cleanup. No detailed vulnerability details are provided at this time...

The vulnerability of the `ff_mpeg4_decode_picture_header` function in the `libavcodec/mpeg4videodec.c` file of the FFmpeg multimedia library, related to pointer arithmetic errors, allows attackers to cause a denial-of-service attack.

The vulnerability of the ffmpeg4decodepictureheader function in the libavcodec/mpeg4videodec.c file of the FFmpeg multimedia library is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a service failure by using a specially created AVI file...

Malicious code in language-matlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c3bff0146045d9130d2bb2523e15b9f1e582a33f6ba1e2a33524ffe5bb05732 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in usss (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 252cdf6830dae64423e603510c0465768ef7d1134896697f352a8949c12d5c2c A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in huggingfaces-hub (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 030324e12766820002cc282dbac28f60bb0f2fc82d459e96c82f073a14e75592 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...