CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55555

Invoice Ninja versions before 5.10.43 are vulnerable to unauthenticated remote code execution (RCE) via a PHP deserialization flaw. The vulnerability exists in the route/{hash} route (defined in invoiceninja/routes/client.php), which accepts a Laravel ciphered value and passes it to the decrypt f...

Malicious code in spinal-env-viewer-plugin-documentation-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3d2a0a560ea9b62097643b0b538b82a0eba36ef923886755262eeecca376650 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-53257

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

GO-2024-3306 Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess

Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess...

Vitess allows HTML injection in /debug/querylogz & /debug/env

Summary The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. Details These pages are rendered using text/template instead of rendering with a proper HTML...

GHSA-7MWH-Q3XM-QH6P Vitess allows HTML injection in /debug/querylogz & /debug/env

Summary The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. Details These pages are rendered using text/template instead of rendering with a proper HTML...

AZL-53970 CVE-2024-53257 affecting package vitess for versions less than 19.0.4-7

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

CVE-2024-53257 Vitess allows HTML injection in /debug/querylogz & /debug/env

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

Vitess 安全漏洞

Vitess is a database clustering system for horizontally scaling MySQL from the Vitess open source. A security vulnerability exists in Vitess that stems from the /debug/querylogz and /debug/env pages of vtgate and vttablet not properly escaping user input...

Malicious code in spinal-env-viewer-graph-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15cfd840bc992aaee2f17022820c0f005a0e47a499c6939bc0ee0c5635cd47fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for postgresql14

This update for postgresql14 fixes the following issues: CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference bsc1233323. CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiatio...

nope-env (1.0.0) potentially affected by CVE-2020-26309 via nope-validator (0.11.3)

nope-validator NPM version 0.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on nope-validator and may be impacted: - nope-env 1.0.0 Source cves: CVE-2020-26309 Source advisory: OSV:GHSA-3PHV-83CJ-P8P7...

MAL-2024-9596 Malicious code in env-debug-logger (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in config.env-replace (npm)

--- -= Per source details. Do not edit below this line.=-...

Snipe-IT remote code execution

Snipe-IT before 7.0.10 allows remote code execution associated with cookie serialization when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values...

CVE-2024-48987

Snipe-IT before 7.0.10 allows remote code execution associated with cookie serialization when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values...

CVE-2024-48987

The Snipe-IT asset management system (versions prior to 7.0.10 ) is vulnerable to Remote Code Execution (RCE) . The root cause is the deserialization of untrusted data during the cookie-handling process. An attacker can execute arbitrary code on the server if they know the APP_KEY ; this risk is ...

CVE-2024-48987

Snipe-IT before 7.0.10 allows remote code execution associated with cookie serialization when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values...