@discordjs/opus vulnerable to Denial of Service

All versions of the package @discordjs/opus are vulnerable to Denial of Service DoS due to providing an input object with a property toString to several different functions. Exploiting this vulnerability could lead to a process crash...

PT-2024-5732 · Cisco · Cisco Ios Xr

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software affected versions not specified Description: The issue is related to an error in the software build process, allowing an authenticated, local attacker with high privileges to bypass the Cisco Secure Boot functionality an...

CVE-2024-40728

creationtimestamp| type| source ---|---|--- 2024-07-09 20:39:56+00:00| seen| https://t.me/cvedetector/413...

Arbitrary Code Execution

typo3/cms is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper handling of TSconfig fields in backend forms, allowing injection of malicious sequences and directory traversal...

SUSE-SU-2024:2379-1 Security update for jbigkit

This update for jbigkit fixes the following issues: - CVE-2022-1210: Fixed denial of service in TIFF File Handler bsc1198146...

CVE-2024-38055

Microsoft Windows Codecs Library Information Disclosure Vulnerability...

CVE-2024-6527

SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and obtain administrator's token to modify the content of pages. This issue affects MegaBIP software versions through 5.13...

BELL-CVE-2024-22020

Bulletin has no description...

SUSE CVE-2024-39695

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds...

Khoj Open Redirect Vulnerability in Login Page

Summary An attacker can use the next parameter on the login page to redirect a victim to a malicious page, while masking this using a legit-looking app.khoj.dev url. For example, https://app.khoj.dev/login?next=//example.com will redirect to the https://example.com page. Details The problem seems...

GHSA-3V33-3WMW-3785 yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Impact yt-dlp's DouyuTV and DouyuShow extractors used a cdn.bootcdn.net URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net is owne...

Cross-Site Request Forgery (CSRF)

mudler/localai is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is caused due to insufficient CSRF protection mechanisms on the model deletion functionality, which allows an attackers o trick victims into deleting installed models...

MAL-2024-7431 Malicious code in portal-ui-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52ed4030d37e53e09fa9a44db9742e1fde7399bd6de75e13e86d290b88a22251 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-PHG7-8MM9-GJ88 EGroupware mishandles an ORDER BY clause

EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajaxgetrows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting...

CGA-GPWC-7F5F-8M65

Bulletin has no description...

CGA-VC2M-GVQX-PVQX

Bulletin has no description...

BELL-CVE-2024-39474

Bulletin has no description...

CVE-2024-27713

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Response Header Settings component...

CVE-2024-39174

A cross-site scripting XSS vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article...

PT-2024-27738 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: Insecure permissions in the component "/api/admin/user" of 14Finger allow attackers to access all user information via a crafted GET request. The username and other sensitive information can be accessed throu...