CVE-2024-43035

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1...

Lego’s Smart Bricks explained: what they do, and what they don’t

Lego just made what it claims is its most important product release since it introduced minifigures in 1978. No, it's not yet another brand franchise. It's a computer in a brick. Called the Smart Brick , it's part of a broader system called Smart Play that Lego hopes will revolutionize your child...

WordPress和WordPress plugin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

fluidsynth 资源管理错误漏洞

fluidsynth is a fluidsynth open source application. It is used to generate audio by reading and processing MIDI events from MIDI input devices using SoundFont. A resource management error vulnerability exists in fluidsynth versions prior to 2.5.2, which stems from a contention condition when...

PT-2025-52858

Name of the Vulnerable Software and Affected Versions FluidSynth versions 2.5.0 through 2.5.1 Description FluidSynth, a software synthesizer based on the SoundFont 2 specifications, contains a flaw. A race condition during the unloading of a DLS file can lead to a heap-based use-after-free. This...

EUVD-2005-4189

Malware in sbrugna...

EUVD-2022-4113

Malicious code in bioql PyPI...

EUVD-2022-5694

Malicious code in bioql PyPI...

CVE-2020-2098

A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2097

Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2024-56897

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset...

CVE-2024-56897

Improper access control in the HTTP server in YI Car Dashcam v3.88 allows unrestricted file downloads, uploads, and API commands. API commands can also be made to make unauthorized modifications to the device settings, such as disabling recording, disabling sounds, factory reset...

Malicious code in nylas-private-sounds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 612de4025068333f24bd17ea9b89669c891d1b53d78404a37c1dfaf655126501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10897 Malicious code in nylas-private-sounds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 612de4025068333f24bd17ea9b89669c891d1b53d78404a37c1dfaf655126501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

3abn (>=1.0.0, <=2.1.11), @2003scape/rsc-sounds (>=1.0.0, <=1.0.1) +380 more potentially affected by CVE-2024-21526 via speaker (>=0.0.10, <=0.5.5)

speaker NPM version =0.0.10, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.5 and more Source cves: CVE-2024-21526 Source advisory: OSV:GHSA-W5FC-GJ3H-26RX...

MAL-2024-164 Malicious code in discord.js-sounds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdfa47c01e5a71fae385f0e33ccdecc9e8af079d01f3f8e400032bfb6a524b6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord.js-sounds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdfa47c01e5a71fae385f0e33ccdecc9e8af079d01f3f8e400032bfb6a524b6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-sounds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd6b0c891e0a48196a53cec18f1cce102281436e4acbf4a45af7444166378496 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8638 Malicious code in discord-sounds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd6b0c891e0a48196a53cec18f1cce102281436e4acbf4a45af7444166378496 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

sounds-for-free.de Improper Access Control vulnerability OBB-3771436

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...