13092 matches found
MGASA-2024-0253 Updated krb5 packages fix security vulnerabilities
Before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application. CVE-2024-37370 Before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending...
Improper Enforcement Of Behavioral Workflow
aimeos/ai-controller-frontend is vulnerable to Improper Enforcement of Behavioral Workflow. The vulnerability is due to not resetting the payment status of a user's basket after the user completes a purchase...
CVE-2024-38519 yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-...
BELL-CVE-2024-38474
Bulletin has no description...
BELL-CVE-2024-38477
Bulletin has no description...
BELL-CVE-2024-38473
Bulletin has no description...
ASB-A-302570828
Bulletin has no description...
ASB-A-338887097
Bulletin has no description...
PYSEC-2024-176
A reflected Cross-Site Scripting XSS vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a...
DLA-3854-1 tryton-client - security update
Bulletin has no description...
MAL-2024-10209 Malicious code in web3e (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f89f8d8a53f078d8fb75734855ceba0501a8b4c71fc4e81622ad0eaf56ccd949 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: funcaptcha-ru Reasons based on the campaign: - infostealer...
MAL-2024-10199 Malicious code in web2 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3a75e3927a62be623b592f888af0f7be16ed76042e542fb94cd592311ef2c52b --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: funcaptcha-ru Reasons based on the campaign: - infostealer...
MAL-2024-10016 Malicious code in ethherum (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 09e4bd568ed9a4333dacb1a455a225dddfc4b58990ab58f9ea7ab92784723c61 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: funcaptcha-ru Reasons based on the campaign: - infostealer...
MAL-2024-10126 Malicious code in pytbon (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7e897d020793f301d80ad877422b237986c99c6bad861618a93a53fe5a2b7c26 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: funcaptcha-ru Reasons based on the campaign: - infostealer...
MAL-2024-10096 Malicious code in opesnea (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f69710d07fc69132e751be9316b166b13d2f1a434eb3523c75a132ea827da7ee --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: funcaptcha-ru Reasons based on the campaign: - infostealer...
MAL-2024-10079 Malicious code in openseax (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ec03d53d7d2432e27da1d77449f8fb3988d72c9ad4c7d9950dffa1fa0830e3c5 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: funcaptcha-ru Reasons based on the campaign: - infostealer...
MAL-2024-9955 Malicious code in bussardweg4av2 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5dc2b9d9e5d1ece75c0261406e9630389fdc48845f2aa80aa2bc9ad61897531c --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: funcaptcha-ru Reasons based on the campaign: - infostealer...
GO-2024-2479 Authentik vulnerable to PKCE downgrade attack in goauthentik.io
Authentik vulnerable to PKCE downgrade attack in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
Security Bulletin: Vulnerability in Node.js affects IBM Process Mining CVE-2024-28849
Summary There is a vulnerability in Node.js that could allow an remote authenticated attacker to obtain sensitive information on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...