Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50.
The npm package '511fola' version 1.0.0 and 99.99.99 was found to contain malicious code. This indicates that the package itself is compromised and may perform unauthorized or harmful actions when used. There is no information about active exploitation in the wild or a CVSS score. No patch or remediation details are provided.
Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.
The 'queenbee-plugin' RubyGems package versions including 90002.0, 99.0.0 through 99.0.8 are identified as malicious. The package communicates with domains linked to malicious activity and executes commands associated with harmful behavior. There is no CVSS score or official patch information available for this threat.
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763803709 and Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9 are mission CSRF protections in its tracker field dependencies, allowing attackers to modify tracker fields. This issue is fixed in Tuleap Community Edition version 17.0.99.1763803709 and Tuleap Enterprise Edition versions 17.0-4 and 16.13-9.
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker triggers. This issue is fixed in Tuleap Community Edition version 17.0.99.1763126988 and Tuleap Enterprise Edition versions 17.0-3 and 16.13-8.
Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.
Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. This issue is fixed in version Tuleap Community Edition version 17.0.99.1762444754 and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.
Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.
The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.99-RC2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347 and Tuleap Enterprise Edition prior to versions 17.01-, 16.13-6, and 16.12-9 don't have cross-site request forgery protections in the file release system. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1762267347, Tuleap Enterprise Edition 17.0-1, Tuleap Enterprise Edition 16.13-6, and Tuleap Enterprise Edition 16.12-9 fix the issue.
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675 and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 don't have cross-site request forgery protection in the management of SVN commit rules and immutable tags. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1761813675, Tuleap Enterprise Edition 16.13-5, and Tuleap Enterprise Edition 16.12-8 contain a fix for the issue.
The npm package 'sechub-openapi-ts-client' version 99.0.0 contains malicious code that communicates with a domain linked to malicious activity and executes commands associated with harmful behavior. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system must be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'sechub-openapi-typescript' version 99.0.0 contains malicious code that communicates with a domain linked to malicious activity and executes commands associated with harmful behavior. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system must be rotated immediately from a separate, secure machine. Removing the package alone may not eliminate all malicious software introduced by it.
The npm package 'kubeflow' version 99.0.0 contains malicious code that communicates with a domain linked to malicious activity and executes commands associated with harmful behavior. Installing or running this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different machine are strongly advised, although removal may not fully eradicate the malicious presence.
The npm package 'radial-chart' version 99.0.0 contains malicious code that communicates with a domain linked to malicious activity and executes commands associated with harmful behavior. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system must be rotated immediately from a different, secure machine. Removal of the package alone may not eliminate all malicious software introduced by it.
The npm package 'example-icrc35-shared-library' version 99.0.0 has been identified as malicious. It contains code that communicates with domains linked to malicious activity and executes commands associated with harmful behavior. This poses a risk to users who install or use this package.