PYSEC-2024-127

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

CVE-2023-47116

Summary: CVE-2023-47116 affects Label Studio versions before 1.11.0 (tested on 1.8.2). The SSRF protection that is enabled via SSRF_PROTECTION_ENABLED can be bypassed because SSRF validation only checks a single DNS lookup before the request, and does not validate the final destination IP, allowi...

BIT-WORDPRESS-2021-39203

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This...

BIT-WORDPRESS-MULTISITE-2021-39202

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...

Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

Design/Logic Flaw

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in some situations. This vulnerability only affects Discourse instances which have disabled the default Content Security Policy. The vulnerability is patched in 3.1.5 and 3.2.0.beta...

CVE-2024-23834

Discourse (open-source discussion platform) has an XSS vulnerability when user input is not properly sanitized and Content Security Policy is disabled. The issue affects instances where CSP is not enabled and allows unsafe-inline; it is fixed in Discourse 3.1.5 and 3.2.0.beta5. To remediate, enab...

Design/Logic Flaw

Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to circumvent the protection that PKCE offers. PKCE adds the codechallenge parameter to the authorization request and adds the codeverifier parameter to the token request. Prior to...

Free Open-Source Inventory Management System Security Vulnerability

Inventory Management System is an inventory management system by stemword individual developers. A security vulnerability exists in Free Open-Source Inventory Management System version v.1.0. A remote attacker can exploit this vulnerability to execute arbitrary code via the Stafflist parameter in...

ALSA-2024:0608 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.7.0 ESR. Security Fixes: Mozilla: Out of bounds write in ANGLE CVE-2024-0741 Mozilla: Failure to update user input timestamp CVE-2024-0742...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.7.0 ESR. Security Fixes: Mozilla: Out of bounds write in ANGLE CVE-2024-0741 Mozilla: Failure to update user input timestamp CVE-2024-0742...

vantage6 Security Vulnerabilities

vantage6 is a vantage6 open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability previously existed in vantage6 version 4.2.0 that stemmed from an authenticated user being able to inject code into an algorithmic environment variable...

CVE-2023-51813

CVE-2023-51813 describes a CSRF vulnerability in the Free Open-Source Inventory Management System v1.0. The issue arises via the staff_list parameter in the index.php component, allowing a remote attacker to execute arbitrary code. The available documents do not specify affected build details bey...

PT-2024-14304 · Unknown · Free/Open Source Inventory Management System

Name of the Vulnerable Software and Affected Versions: Free Open-Source Inventory Management System version 1.0 Description: A Cross Site Request Forgery CSRF issue allows a remote attacker to execute arbitrary code via the staff list parameter in the "index.php" component. This enables the...

Apache Kylin Information Disclosure Vulnerability (CNVD-2024-22238)

Apache Kylin is the United States Apache Apache Foundation of an open source distributed analytical data warehouse . The product mainly provides Hadoop/Spark on top of the SQL query interface and multidimensional analysis OLAP and other functions. Apache Kylin suffers from an information disclosu...

vantage6 Security Vulnerabilities

vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability previously existed in vantage6 version 4.2.0 that stemmed from the ability to find out a username from the response time of a login request...

TanStack Query Cross-Site Scripting Vulnerability

TanStack Query is an open source, full-featured, TypeScript-enabled library from TanStack Open Source. A cross-site scripting vulnerability exists in TanStack Query. An attacker can exploit this vulnerability to inject malicious input...

authentik Authorization Issues Vulnerability

authentik is an open source identity provisioning application from authentik Open Source. An authorization issue vulnerability exists in Authentik versions prior to 2023.8.7 and 2023.10.7, which stems from a security issue in authentik's PKCE that allows an attacker to bypass the protections...

vantage6 安全漏洞

vantage6 is vantage6 open source an open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability exists in vantage that stems from the fact that input is not checked to see if it is encrypted if the task is created in encrypted...

AllaKore RAT’s Grip Tightens on Mexican Financial Institutions

Summary: A threat actor has been targeting Mexican banks and cryptocurrency trading since at least 2021. Using custom installers, the actor distributes a modified version of the AllaKore RAT, an open-source remote access tool. The campaign cleverly mimics the Mexican Social Security Institute IMS...