Notepad++ 安全漏洞

Notepad++ is an open source plain text editor by Don Ho, an individual developer in Taiwan, China. A security vulnerability exists in Notepad++, which stems from a heap buffer write overflow vulnerability in the Utf816Read::convert function...

KNX Connection Authorization 安全漏洞

KNX Connection Authorization is a network security product from KNX Open Source. KNX Connection Authorization suffers from a security vulnerability that stems from the fact that it is easy to be locked out and that users cannot reset them to gain access to the device...

FreeImage load function buffer overflow vulnerability

FreeImage is a cross-platform open source library for supporting popular graphic image formats. A buffer overflow vulnerability exists in the FreeImage load function that can be exploited by an attacker to execute arbitrary code on a system or cause a denial of service attack...

Server side request forgery (ssrf)

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint /proxy/?url= does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and...

Design/Logic Flaw

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue...

CVE-2023-40017 Geonode Server Side Request Forgery vulnerability

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint /proxy/?url= does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and...

CVE-2023-40017

GeoNode versions 3.2.0–4.1.2 are affected by an SSRF vulnerability in the /proxy/?url= endpoint that enables port-scanning internal hosts and proxying data from internal services. Root cause is improper protection against SSRF. A patch is available at commit a9eebae80cb362009660a1fd49e105e7cdb499...

CVE-2023-39519

CVE-2023-39519 affects CloudExplorer Lite (open source cloud management platform). Prior to version 1.4.0, there is a vulnerability in how user information is retrieved that can lead to leakage of sensitive data. The issue has been fixed in version 1.4.0. Detailed entries across multiple sources ...

CVE-2023-39521

CVE-2023-39521 affects Tuleap, where content in the Kanban and PV2 apps’ card fields is not properly escaped. The issue can be triggered when an agile dashboard administrator deletes a kanban with a malicious label, potentially allowing uncontrolled code execution. Affected products/versions: Tul...

CVE-2023-37469

CVE-2023-37469 is a CasaOS Command Injection vulnerability that affects versions prior to 0.4.4. An authenticated CasaOS user who can connect to a controlled SMB server can execute arbitrary commands on the system. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity,...

Introducing Wordfence CLI: A High Performance Malware Scanner Built for the Command Line

Today, we are incredibly excited to announce the launch of Wordfence CLI: an open source, high performance malware scanner built for the command-line. With Wordfence CLI you can detect malware and other indicators of compromise on a host system by running an extremely fast scanner that is at home...

The Last Hour Before Yevgeny Prigozhin's Plane Crash

Russia tightly controls its information space—making it hard to get accurate information out of the country. But open source data provides some clues about the crash...

Lazarus Group's infrastructure reuse leads to discovery of new malware

In the Lazarus Groups latest campaign, which we detailed in a recent blog, the North Korean state-sponsored actor is exploiting CVE-2022-47966, a ManageEngine ServiceDesk vulnerability to deploy multiple threats. In addition to their "QuiteRAT" malware, which we covered in the blog, we also...

firefox bug fix update

An update is available for firefox. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Firefox is an open-source web browser, designed for standards...

Malicious code in gradient-function (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d41bbe2c82b0cb7c5410006430478c3cc70133f726eda4f584c0f7f943ff938 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

shescape 安全漏洞

Shescape is open source a simple shell escaping program package for JavaScript . Use it to escape user-controlled input to shell commands to prevent shell injection. A security vulnerability exists in versions of shescape prior to 1.7.4 that stems from escaping or referencing the wrong shell,...

CVE-2022-48554

File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: "File" is the name of an Open Source project...

CVE-2022-48554

File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: "File" is the name of an Open Source project...

AZL-28055 CVE-2022-48554 affecting package file for versions less than 5.40-3

File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: "File" is the name of an Open Source project...

Stack overflow

File before 5.43 has an stack-based buffer over-read in filecopystr in funcs.c. NOTE: "File" is the name of an Open Source project...