13090 matches found
MGASA-2024-0330 Updated quictls packages fix security vulnerabilities
The updated packages fix security vulnerabilities...
MAL-2024-9228 Malicious code in duckc2-v5.3.3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b592408b0378349ea039f5609350090b988b983226d34cfdcb1a741768642c2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-9211 Malicious code in manoj-app-css-alt (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c88dab3b32782f38a2c1b962d842f1c4c52400df0c5622d73f4989ebc8381f6 The OpenSSF Package Analysis project identified 'manoj-app-css-alt' @ 9.1.1 npm as malicious. It is considered malicious because: - The package...
MAL-2024-9241 Malicious code in multiply-proxy-actions-contracts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3f66afd5c02eab401c82eb66ea7de027666d3b52b50915f0859b21e1b374456 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-3656 vulnerabilities
Vulnerabilities for packages: keycloak-fips...
BELL-CVE-2024-43484
Bulletin has no description...
MAL-2024-9155 Malicious code in juno-composer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87b94bdf6eefb534b5a6861dbb649f8b917be121e14576d40becf3f97a9e5828 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-9183 Malicious code in sdk-integration-tests (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03dafa3e57d86169a6645da2a922b01ee1da954a3b98e6cf5c31c63575cdd133 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046
This module enables you to manage blocks from specific modules in the specific themes. The module doesn't sufficiently check permissions under the scenario when a block is added using the form "/admin/structure/block/add/pluginid/theme" route "block.adminadd". The attacker can add the block to th...
CVE-2024-9603
Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2024-43497
DeepSpeed Remote Code Execution Vulnerability...
MAL-2024-11517 Malicious code in agent-user-generate (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 514af1dfd929068fabc7527812b99ec6a287c3601d7cf4ed1d29c55e74339fac Inside the library there is a part running code hidden in the attached image, which then exfiltrate user-provided data, downloads and install next stage code,...
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability
Summary A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/cleansyncdir endpoint. The dirname POST parameter is not validated/sanitized and is used to construct the syncDir that is deleted by calling fs.rm. Details - file:...
BELL-CVE-2024-46955
Bulletin has no description...
CVE-2024-46278
Teedy 1.11 is vulnerable to Cross Site Scripting XSS via the management console...
MAL-2024-11584 Malicious code in exflibrary (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 95deb938eb8fd38976a38faf2fd2117318966fc829c080f35d6d999ff37d1236 When importing the module and a specific file exists in the current directory, obfuscated code downloads and starts the next stage of obfuscated code cstealer...
Malicious code in titan-osint (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e8dccaf6be8892f2b8871e634607d1dafc9fbb2b5855156959c454b07ab184aa osint packages promise to be OSINT tool, however, when providing the username to search for, the package attempts to exfiltrate Discord tokens from the user. T...
Open Solutions For Education OpenSis-Classic 安全漏洞
Open Solutions For Education OpenSis-Classic is an open source commercial-grade, secure, scalable and intuitive student information system, school management software from Open Solutions For Education, USA. A security vulnerability exists in Open Solutions For Education OpenSis-Classic v9.1. An...