Malicious code in cms-core-redux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3940178777e39b1b416f9ed8d09fdf519cf9f5a3e2de2361da01655b196991d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-50344

I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context...

CVE-2024-50344 I, Librarian has a Stored XSS vulnerability in Supplemental Files

I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context...

CVE-2024-50344 I, Librarian has a Stored XSS vulnerability in Supplemental Files

I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context...

Mattermost Information Disclosure Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an information disclosure vulnerability that stems from an inability to properly filter channel data, which can be exploited by an attacker to obtain private channel names using...

Code-Projects Blood Bank System SQL注入漏洞

Code-Projects Blood Bank System is an open source blood bank management system from Code-Projects. A SQL injection vulnerability exists in Code-Projects Blood Bank System version 1.0, which stems from an incorrect manipulation of the Bloodname parameter that can lead to SQL injection...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 For more details about the security issues, includi...

Researchers Uncover Vulnerabilities in Open-Source AI and ML Models

A little over three dozen security vulnerabilities have been disclosed in various open-source artificial intelligence AI and machine learning ML models, some of which could lead to remote code execution and information theft. The flaws, identified in tools like ChuanhuChatGPT, Lunary, and LocalAI...

Mozilla多款产品 安全漏洞

Mozilla Firefox and Mozilla Thunderbird are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open-source web browser. Mozilla Thunderbird is a suite of standalone Mozilla Application Suite Mozilla Thunderbird is a stand-alone e-mail client software from the Mozilla...

Security Bulletin: Multiple Vulnerabilities in Open Source affect Cloud Pak System

Summary Vulnerabilities in Open Source openssl, glibc, expat affect Cloud Pak System . Vulnerability Details CVEID:CVE-2024-28757 DESCRIPTION: libexpat could allow a remote attacker to obtain sensitive information, caused by improper handling of XML external entity XXE declarations by the...

CVE-2024-49771 MPXJ has a Potential Path Traversal Vulnerability

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by t...

[SECURITY] Fedora 40 Update: chromium-130.0.6723.69-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 39 Update: chromium-130.0.6723.69-1.fc39

Chromium is an open-source web browser, powered by WebKit Blink...

Progress Chef Habitat 安全漏洞

Progress Chef Habitat is an open source solution from Progress, Inc. that provides automation capabilities for defining, packaging, and delivering applications to virtually any environment. Progress Chef Habitat has a security vulnerability that stems from susceptibility to Indirect Object...

TinyXML2 安全漏洞

TinyXML2 is a C++ based open source XML parser by Lee Thomason, an individual developer. A security vulnerability exists in TinyXML2 10.0.0 and earlier versions, which stems from a reachable assertion against UINTMAX/16 in tinyxml2.cpp XMLUtil::GetCharacterRef, which may cause the application to...

[SECURITY] Fedora 41 Update: chromium-130.0.6723.58-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 41 Update: suricata-7.0.7-1.fc41

The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine. This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. This new Engine supports Multi-threading, Automatic...

RLSA-2024:7958 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: Use-after-free in Animation timeline 128.3.1 ESR Chemspill CVE-2024-9680 For more details about the security issues, including the impact, a CVSS score,...

RLSA-2024:7700 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: 115.16/128.3 ESR firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service CVE-2024-9399 firefox: thunderbird: Memory safety...

RLSA-2024:8327 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 For more details about the security issues, includi...