Threats Tagged 'osv'

A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 in the /viewdepartment.php file via manipulation of the delid argument. This vulnerability can be exploited remotely and has a CVSS score of 6.3, indicating a moderate severity. No patch or remediation information is currently available. Exploit code has been made public, but there are no known exploits in the wild at this time.

A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 in the /viewbilling.php file via manipulation of the delid argument. This vulnerability can be exploited remotely and has been publicly disclosed. The CVSS score is 6.3, indicating a medium severity level. No patch or remediation information is currently available.

A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 within the /viewroom.php file via manipulation of the delid argument. This vulnerability can be exploited remotely and has publicly disclosed exploit code. The CVSS 3.1 base score is 6.3, indicating a medium severity level with low privileges required and no user interaction needed.

A vulnerability in EricLBuehler Mistral.rs up to version 0.8.22 allows remote attackers to cause an out-of-bounds read via manipulation of tokenizer arguments. The issue affects the convert_gguf_to_hf_tokenizer function in the GGUF Tokenizer component. This vulnerability has a low severity score and can be resolved by upgrading to version 0.8.23.

A security vulnerability (CVE-2026-75093) exists in sonos tract up to version 0.23.4 in the ONNX Initializer Loader component. It affects the function Tensor::from_raw_dt_align in the file data/src/tensor.rs, causing incorrect calculation of buffer size. The vulnerability can be exploited remotely and has been publicly disclosed. The CVSS score is 4.3, indicating a low severity impact primarily affecting availability. A patch identified by commit 66b10bda8895f4bfaf8c205361f0125cdf51f99b is recommended to resolve the issue.

SourceCodester Online Examination & Learning Management System 1.0 contains a cross-site request forgery (CSRF) vulnerability. This vulnerability allows remote attackers to trick authenticated users into performing unwanted actions. The affected functionality is unspecified. The vulnerability has a CVSS 3.1 score of 4.3, indicating a medium severity level.

The npm package 'sui-move-graphql' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys from a separate, secure computer is strongly advised.

The ulebkit package in the npm ecosystem contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.

The npm package 'blastradar' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys from a separate, uncompromised system is strongly advised.

The npm package core-tailwindcss-utility, version 3.7.1, is a malicious package masquerading as a Tailwind CSS utility. Instead of providing CSS utilities, it executes remote code fetched from a hardcoded IP address by dynamically evaluating JavaScript code in the Node.js environment. The package includes suspicious dependencies unrelated to its stated purpose, which facilitate credential decryption and remote command-and-control communication. This behavior enables execution of arbitrary code on the host system, posing a significant security risk.