CVE-2024-1540 Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow

A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, potentially leading to unauthorized...

SUSE-SU-2024:1008-1 Security update for avahi

This update for avahi fixes the following issues: - CVE-2023-38471: Fixed reachable assertion in dbussethostname bsc1216594. - CVE-2023-38469: Fixed reachable assertions in avahi bsc1216598...

CVE-2023-6173

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in TeoSOFT Software TeoBASE allows SQL Injection. This issue affects TeoBASE: through 27032024. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

BELL-CVE-2023-52621

Bulletin has no description...

CVE-2023-45927

S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function ttsprintf...

CVE-2023-46046

An issue in MiniZinc before 2.8.0 allows a NULL pointer dereference via tiexpr in a crafted .mzn file. NOTE: this is disputed because there is no common libminizinc use case in which an unattended process is supposed to run forever to process a series of atttacker-controlled .mzn files...

CVE-2024-24334

A heap buffer overflow occurs in dfsv2 dfsfile in RT-Thread through 5.0.2...

CVE-2024-25393

A stack buffer overflow occurs in net/at/src/atserver.c in RT-Thread through 5.0.2...

CVE-2024-25390

A heap buffer overflow occurs in finsh/mshfile.c and finsh/msh.c in RT-Thread through 5.0.2...

CVE-2024-29041 Express.js Open Redirect in malformed URLs

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an...

CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate SQL Injection Vulnerabilities

Today, CISA and the Federal Bureau of Investigation FBI released a joint Secure by Design Alert, Eliminating SQL Injection Vulnerabilities in Software. This Alert was crafted in response to a recent, well-publicized exploitation of SQL injection SQLi defects in a managed file transfer application...

CVE-2021-47166

In the Linux kernel, the following vulnerability has been resolved: NFS: Don't corrupt the value of pgbyteswritten in nfsdorecoalesce The value of mirror-pgbyteswritten should only be updated after a successful attempt to flush out the requests on the list...

BELL-CVE-2023-6597

Bulletin has no description...

CVE-2024-24725

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/importrun.php&type=externalAssessment&step=4 URI...

openEuler 安全漏洞

openEuler is an operating system from the Open Atomics Open Source Foundation. A security vulnerability exists in openEuler aops-ceres versions 1.3.0 through 1.4.1, which stems from a security issue in ceres/functions/util.Py that allows command injection...

GHSA-F5X3-32G6-XQ36 vulnerabilities

Vulnerabilities for packages: npm, opensearch-dashboards-fips, sqlpad, opensearch-dashboards, pnpm-stage0, py3-jupyterlab, tensorflow-cpu-jupyter, lerna...

BELL-CVE-2024-29018

Bulletin has no description...

CVE-2024-26557

Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter...

GHSA-3QW5-V9CC-V262 Cross site scripting in moodle

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

MAL-2024-1132 Malicious code in caas-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6944959a95e6d1bd73a53289912b43eed0d1855c541983e98a204359c5df0ba6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...