MAL-2024-7916 Malicious code in @incisive/rvtestmodule (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7d7a97077c828bef1cb017c52f30d5cb91bfec081c1cfa8ab832c97dd884961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Accessing Untrusted Directory May Allow Local Privilege Escalation

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB...

GHSA-P3PF-MFF8-3H47 Gorush uses deprecated TLS versions

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version...

BELL-CVE-2024-7006

Bulletin has no description...

CVE-2024-28739

An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter...

Microweber Cross Site Scripting (XSS) vulnerability

Microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\tags\addtaggingtagged.php...

CVE-2024-6472

Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is...

CVE-2024-41381

microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\settings\admin.php...

BELL-CVE-2024-41957

Bulletin has no description...

PT-2024-8735 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where...

GHSA-J6VX-R77H-44WC Apache Linkis arbitrary file deletion vulnerability

In Apache Linkis = 1.5.0, Arbitrary file deletion in Basic management services on a user with an administrator account could delete any file accessible by the Linkis system user. Users are recommended to upgrade to version 1.6.0, which fixes this issue...

PT-2024-25533 · Cosy+ · Cosy+

Name of the Vulnerable Software and Affected Versions: Cosy+ versions 21.x below 21.2s10 Cosy+ versions 22.x below 22.1s3 Description: The issue is related to code injection due to improper parameter blacklisting. This can be exploited with local network access. The estimated number of potentiall...

Information leakage vulnerability in the enterprise version of Zhiyuan A6-m Collaboration Management Software of Beijing Zhiyuan Internet Software Co. Ltd (CNVD-2024-37241)

Zhiyuan A6-m Collaboration Management Software Enterprise Edition is a collaboration management software for small and medium-sized enterprises. There is an information leakage vulnerability in the enterprise version of Zhiyuan A6-m Collaboration Management Software of Beijing Zhiyuan Internet...

PT-2024-29956 · Elliptic +1 · Elliptic +1

Name of the Vulnerable Software and Affected Versions: Elliptic package version 6.5.6 Description: The issue concerns ECDSA signature malleability due to a missing check for whether the leading bit of r and s is zero. This results in a cryptographic weakness. There is no information provided abou...

Security Bulletin: Cloud Pak System is vulnerable to Node.js ReDos (CVE-2022-25883)

Summary ReDos vulnerability found in semver Node.js package affects Cloud Pak System. IBM Cloud Pak System Software has addressed this vulnerability. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package is vulnerable to a denial of service, caused by a regular expression...

GHSA-762M-4CX6-6MF4 Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled...

Mattermost failed to disallow the modification of local users when syncing users in shared channels

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to disallow the modification of local users when syncing users in shared channels. which allows a malicious remote to overwrite an existing local user...

CVE-2024-39832 Permanently local data deletion by malicious remote

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to properly safeguard an error handling which allows a malicious remote to permanently delete local data by abusing dangerous error handling, when share channels were enabled...

Prototype Pollution

@chasemoskal/snapstate is vulnerable to Prototype Pollution. The vulnerability is due to passing arguments crafted with the built-in property proto to the function attemptNestedProperty, which allows an attacker to alter the behavior of all objects inheriting from the affected prototype and...

MAL-2024-7875 Malicious code in boostrapsio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d56d7ae2cc50c737f4b7272c51fef0ec9899e899d19628763c3aa6aad5dfef1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...