CVE-2024-24765 CasaOS-UserService allows unauthorized access to any file

CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user...

PT-2024-20543 · Unknown · Casaos-Userservice

Name of the Vulnerable Software and Affected Versions: CasaOS-UserService versions prior to 0.4.7 Description: The issue concerns a path traversal vulnerability in the UserService API, which allows an unauthorized actor to access any file on the system due to insufficient path filtering for user...

CasaOS Security Vulnerabilities

CasaOS is a simple, easy-to-use, and elegant open source home cloud system. A security vulnerability exists in CasaOS-UserService versions prior to 0.4.4.3 through 0.4.7, which stems from a vulnerability that could allow an attacker to gain superuser-level access via brute-force cracking...

PT-2024-20545 · Casaos · Casaos

Name of the Vulnerable Software and Affected Versions: CasaOS versions 0.4.4.3 through 0.4.6 Description: The CasaOS web application lacks control over login attempts, allowing attackers to perform password brute force attacks and gain full access to the server with super user-level access...

PT-2023-26241 · Gtmetrix · Gtmetrix For Wordpress

Name of the Vulnerable Software and Affected Versions: GTmetrix GTmetrix for WordPress plugin versions 0.4.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that...

UBUNTU-CVE-2023-36239

libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWFDEFINEFONTINFO function at parser.c...

Buffer overflow

libming listswf 0.4.7 was discovered to contain a buffer overflow in the parseSWFDEFINEFONTINFO function at parser.c...

libming 安全漏洞

libming is an output library for Flash SWF written in C. A security vulnerability exists in libming listswf version 0.4.7, which originates from the function parseSWFDEFINEFONTINFO containing a buffer overflow vulnerability...

SUSE CVE-2017-5592

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity 0.4.7 - 0.5.0...

SUSE CVE-2021-29136

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used...

DEBIAN-CVE-2022-33903

Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation...

CVE-2022-31502

The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

wormnest 路径遍历漏洞

wormnest is a Python3 Flask/SQL-Alchemy web server for URL narrowing and manipulating file services by individual developer John Torakis in Greece. A path traversal vulnerability exists in wormnest version 0.4.7, which stems from insecure use of the Flask sendfile function...

Popcorn Time 跨站脚本漏洞

Popcorn Time is a multi-platform BitTorrent client. version 0.4.7 of Popcorn Time is vulnerable to a cross-site scripting vulnerability that originates in the setting page Movies API Servers field's lack of data validation filtering for user-supplied data and output. An attacker could exploit the...

SUSE-SU-2021:1863-1 Security update for umoci

This update for umoci fixes the following issues: Update to v0.4.7 bsc1184147. - CVE-2021-29136: Fixed overwriting of host files via malicious layer bsc1184147...

md4c -- DoS attack

[email protected] reports: mdanalyzeline in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a denial of service via a malformed Markdown document...

md4c 安全漏洞

md4c Markdown for C is an individual developer's implementation of the Markdown parser in C. A security vulnerability exists in md4c 0.4.7 that allows an attacker to exploit the vulnerability to trigger the use of uninitialized memory and cause a denial of service via a malformed Markdown documen...

PT-2021-18100 · Open Container Initiative +1 · Umoci +1

Name of the Vulnerable Software and Affected Versions: Open Container Initiative umoci versions prior to 0.4.7 Description: The issue allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used. This is due...

GHSA-3WJM-33MW-H388 Malicious Package in s3asy

Version 0.4.8 of s3asy contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.4.8 of this module is found installed you will want ...

node-wakeup (0.1.0) potentially affected by CVE-2020-7684 via rollup-plugin-serve-favicon (0.4.7)

rollup-plugin-serve-favicon NPM version 0.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on rollup-plugin-serve-favicon and may be impacted: - node-wakeup 0.1.0 Source cves: CVE-2020-7684 Source advisory: SNYK:JS-ROLLUPPLUGINSERVEFAVICON-585950...