MAL-2024-12016 Malicious code in oj-odcs-product-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 709903d8ce577ec3a287d787ad000d277c61e0c9a427262948b5e61986e5f320 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2024:4284-2 Security update for curl

This update for curl fixes the following issues: - CVE-2024-11053: Fixed password leak in curl used for the first host to the followed-to host under certain circumstances bsc1234068...

MAL-2024-12027 Malicious code in pzh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 004f5cb74f23f56bc002de95c9577243f64b2b9e66486ed8054b890039377d87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-53580

A flaw was found in iperf. This vulnerability allows a Denial of Service DoS via the injection of malformed JSON data, which can result in a segmentation fault when a NULL pointer is passed to strdup. Mitigation Mitigation for this issue is either not available or the currently available options ...

Cleo < 5.8.0.24 Unrestricted File Upload

Cleo Harmony prior to 5.8.0.24, VLTrader prior to 5.8.0.24 and LexiCom prior to 5.8.0.24 are affected by a vulnerability allowing an unauthenticated attacker to upload an arbitrary file that could lead to remote code execution. No source data...

QOS.CH logback-core Server-Side Request Forgery vulnerability

Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in XML configuration files...

CVE-2024-45338

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-55953 Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability

DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised ...

CVE-2024-4996

CVE-2024-4996 affects Wapro ERP Desktop prior to 8.90.0. Root cause is a hard-coded database administrator password created during installation, allowing an attacker to retrieve embedded sensitive data. Described impact includes high confidentiality/integrity/availability concerns; CVSS scores in...

RHSA-2024:11094 Red Hat Security Advisory: python36:3.6 security update

Bulletin has no description...

Information Leakage

io.undertow, undertow-core is vulnerable to Information Leakage. The vulnerability is due to the incorrect reuse of an HTTP request header value from a previous stream for a subsequent stream on the same HTTP/2 connection, allowing an attacker to potentially leak information between requests...

GHSA-V528-6RQ9-H6GW Spatie Browsershot Directory Traversal vulnerability

Versions of the package spatie/browsershot before 5.0.2 are vulnerable to Directory Traversal due to URI normalisation in the browser where the file:// check can be bypassed with file:\. An attacker could read any file on the server by exploiting the normalization of \ into /...

UniSharp Laravel Filemanager Code Injection vulnerability

Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution RCE through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code...

CVE-2024-53240

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: fix crash when removing device When removing a netfront device directly after a suspend/resume cycle it might happen that the queues have not been setup again, causing a crash during the attempt to stop the queues...

CVE-2024-56318

In raw\TCP.cpp in Matter aka connectedhomeip or Project CHIP through 1.4.0.0 before 27ca6ec, there is a NULL pointer dereference in TCPBase::ProcessSingleMessage via TCP packets with zero messageSize, leading to denial of service...

GHSA-JXW2-JVXF-5VRP Databricks JDBC Driver Command Injection vulnerability

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

CVE-2024-52949

iptraf-ng 1.2.1 has a stack-based buffer overflow. In src/ifaces.c, the strcpy function consistently fails to control the size, and it is consequently possible to overflow memory on the stack...

CVE-2024-55057

Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts...

ALSA-2024:11237 Moderate: libsndfile:1.0.31 security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fixes: libsndfile: Segmentation fault error in oggvorbis.c:417 vorbisanalysiswrote CVE-2024-50612 For more details about the security issues, including the impact, a CVSS score,...

CVE-2024-12665 ruifang-tech Rebuild Task Comment Attachment Upload cross site scripting

A vulnerability, which was classified as problematic, was found in ruifang-tech Rebuild 3.8.5. Affected is an unknown function of the component Task Comment Attachment Upload. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...