Litespeed Technologie LiteSpeed QUIC Security Vulnerability

Litespeed Technologie LiteSpeed QUIC LSQUIC is an open source implementation of QUIC and HTTP/3 functionality for servers and clients from Litespeed Technologie, USA. A security vulnerability exists in Litespeed Technologie LiteSpeed QUIC versions prior to 4.0.4, which stems from a mishandled...

Simple School Managment System SQL注入漏洞

Simple School Managment System is Code-projects open source a simple school management system . A security bypass vulnerability exists in Simple School Managment System, which can be exploited by an attacker to bypass authentication and gain administrative access...

Fedora: Security Advisory (FEDORA-2024-5745525066)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CISA Partners With OpenSSF Securing Software Repositories Working Group to Release Principles for Package Repository Security

Today, CISA partnered with the Open Source Security Foundation OpenSSF Securing Software Repositories Working Group to publish the Principles for Package Repository Securitylink is external framework. Recognizing the critical role package repositories play in securing open source software...

l8w8jwt Security Breach

l8w8jwt is an open source, minimal, OpenSSL-free and ultra-lightweight JWT library written in C by Glitched Polygons GmbH. A security vulnerability exists in version 2.2.1 of l8w8jwt, which stems from the use of memcmp to authenticate, resulting in an authentication bypass vulnerability...

WikiDiscover Cross-Site Scripting Vulnerability

WikiDiscover is a Miraheze open source extension for CreateWiki hosted farms. A cross-site scripting vulnerability exists in previous versions of WikiDiscover 267e763a0d7460f001693c42f67717a0fc3fd6bb. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

CVE-2024-24815

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA...

Announcing TotalCloud™ 2.0 with TruRisk™ Insights: The Future of Cloud and SaaS Security

Rapid cloud and SaaS adoption is driving digital transformation thats reshaping business agility and scalability, making cloud and SaaS security more critical than ever. Recognizing this shift, in November 2022, Qualys launched TotalCloud – an AI-powered cloud-native application protection platfo...

CVE-2024-23344

CVE-2024-23344 describes an information-disclosure risk in Tuleap where, during a multi-user permission validation, some users could access restricted information (e.g., contents of artifacts or email notifications). The issue is categorized as an authorization/bypass-type disclosure affecting Tu...

CVE-2024-23344 Tuleap's content of artifacts might be readable by unauthorized users

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users e.g. mail notifications. This issue has been patched in version 15.4.99.140 of Tuleap...

Open redirect

pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the getredirecturl function when redirecting users at login. This vulnerability h...

CVE-2024-24808

CVE-2024-24808 affects the pyLoad open-source Download Manager. The issue is an open redirect caused by improper validation in the login redirect flow, specifically how URLs are validated via the get_redirect_url/is_safe_url path. The vulnerability is mitigated by a patch in commit fe94451. Sever...

CVE-2024-24808 pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the getredirecturl function when redirecting users at login. This vulnerability h...

Juanpao JPShop Code Issue Vulnerability

JPShop is an open source community group-buying micro-mall applet. A code issue vulnerability exists in Juanpao JPShop version 1.5.02 and prior versions, which stems from an incorrect operation of the parameter picurl that can lead to unrestricted uploads...

Juanpao JPShop Security Vulnerability

JPShop is an open source community group buying micro mall applet. A security vulnerability exists in Juanpao JPShop version 1.5.02 and prior versions, which stems from the use of hard-coded keys...

Tuleap Information Disclosure Vulnerability

Tuleap is an open source application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. Tuleap suffers from an information disclosure vulnerability that stems from the fact that when a process...

Jspxcms Cross-Site Scripting Vulnerability

Blue Intelligence Technology Jspxcms is a scalable enterprise-level open source web content management system CMS from China's Blue Intelligence Technology Company. A cross-site scripting vulnerability exists in Jspxcms version 10.2.0. An attacker can exploit this vulnerability to perform...

CVE-2024-24595

CVE-2024-24595 affects Allegro AI ClearML (open-source) with a plaintext password storage flaw in the MongoDB instance, causing potential leakage of user emails and passwords. Root cause: credentials stored unencrypted in MongoDB. Impact: server compromise possible; confidentiality and integrity ...

CVE-2024-24574

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side XSS. This vulnerability has been patched in version 3.2.5...

Design/Logic Flaw

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side XSS. This vulnerability has been patched in version 3.2.5...