Contour 安全漏洞

Contour is a Project Contour open source Kubernetes entry controller using the Envoy proxy. A security vulnerability exists in Contour 1.28.3 and earlier versions, which stems from the presence of an insecure privilege vulnerability that allows an attacker to access sensitive data and elevate...

Matter 安全漏洞

Matter is a unified open source application layer connectivity standard open sourced by the Connectivity Standards Alliance. Designed to enable developers and device manufacturers to connect and build reliable, secure ecosystems and improve compatibility between connected home devices. A security...

Chaos Mesh 安全漏洞

Chaos Mesh is an open source cloud-native engineering platform from Chaos Mesh Open Source. A security vulnerability exists in Chaos Mesh 2.6.3 and earlier versions, which stems from the presence of an insecure privilege vulnerability that allows an attacker to access sensitive data and elevate...

1Panel SQL Injection Vulnerability

1Panel is a product of Hangzhou Feizhiyun Information Technology Co., Ltd. and is a modern, open source Linux server operation and maintenance management panel. 1Panel exists SQL injection vulnerability, the vulnerability is due to the existence of 1Panel multiple improper filtering, an attacker...

Canarytokens 安全漏洞

Canarytokens is an open source web activity tracking system from Thinkst Applied Research. A security vulnerability exists in Canarytokens that stems from a cross-site scripting vulnerability discovered in the Cloned Website feature...

Canarytokens 安全漏洞

Canarytokens is an open source web activity tracking system from Thinkst Applied Research. A security vulnerability exists in Canarytokens that stems from a server-side request forgery vulnerability that was discovered in the Webhook alert feature...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2024-660)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-660 advisory. OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointi...

Apache HTTP Server Information Disclosure Vulnerability (CNVD-2024-33815)

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. An information disclosure vulnerability exists in Apache HTTP Server, which can be exploited by an attacker to cause source code...

[SECURITY] Fedora 40 Update: chromium-126.0.6478.182-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

Two of Wallarm’s Open-source Tools Have Been Accepted into Black Hat Arsenal 2024

We're gearing up with some seriously cool stuff for Black Hat! But first, a little sneak peek - not just one, but TWO of Wallarm's open-source tools will be featured in the Arsenal showcase at Black Hat USA this year. Black Hat Arsenal unites researchers and the open-source community to display...

ThinkSAAS SQL Injection Vulnerability (CNVD-2024-35182)

ThinkSAAS is ThinkSAAS open source a code completely open source , flexible and open building system program . ThinkSAAS version 3.7.0 SQL injection vulnerability exists , the vulnerability stems from the name parameter in the systemactionupdate.php lack of validation of external input SQL...

ROS-20240719-05

A vulnerability in the ejs web application development pattern for Node.Js is related to incorrect neutralization of special elements in the output data used by the input component. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code by injecting...

TAG-100: New Threat Actor Uses Open-Source Tools for Widespread Attacks

Unknown threat actors have been observed leveraging open-source tools as part of a suspected cyber espionage campaign targeting global government and private sector organizations. Recorded Future's Insikt Group is tracking the activity under the temporary moniker TAG-100, noting that the adversar...

Unspecified Vulnerability in Oracle MySQL (CNVD-2024-33173)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in Oracle MySQL Server. An attacker exploiting this vulnerability could cause MySQL Server to hang or crash repeatedl...

CVE-2024-40636

Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, and more. When utilizing multiple Eureka server service UR...

CVE-2024-40640 Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac

vodozemac is an open source implementation of Olm and Megolm in pure Rust. Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw might allow an attacker to infer some...

BIT-DISCOURSE-2024-38360 Denial of service via Watched Words in Discourse

Discourse is an open source platform for community discussion. In affected versions by creating replacement words with an almost unlimited number of characters, a moderator can reduce the availability of a Discourse instance. This issue has been addressed in stable version 3.2.3 and in current...

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference XXE vulnerability that allows for remote code execution...

Malicious npm Packages Found Using Image Files to Hide Backdoor Code

Cybersecurity researchers have identified two malicious packages on the npm package registry that concealed backdoor code to execute malicious commands sent from a remote server. The packages in question – img-aws-s3-object-multipart-copy and legacyaws-s3-object-multipart-copy – have been...