CVE-2023-47804 Apache OpenOffice: Macro URL arbitrary script execution

Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected...

CVE-2023-47804

CVE-2023-47804 affects Apache OpenOffice prior to 4.1.15. It stems from links in documents that call internal macros with arbitrary arguments; in affected versions, user approval for such links isn’t always requested, enabling arbitrary script execution when links are clicked or triggered by docu...

PT-2023-8178 · Apache · Apache Openoffice

Name of the Vulnerable Software and Affected Versions: Apache OpenOffice versions prior to the fixed version Description: The issue is related to insufficient input validation when processing arguments, allowing a remote attacker to execute arbitrary code. Apache OpenOffice documents can contain...

GHSA-335X-5WCM-8JV2 Backoffice User can bypass "Publish" restriction

Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request...

Backoffice User can bypass "Publish" restriction

Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request...

Incorrect Authorization

Overview UmbracoCms.Core is an ASP.NET CMS. Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization mechanism. An attacker with only send for approval permissions could exploit this weakness to publish content without the required publish...

Code injection

Umbraco is an ASP.NET content management system CMS. Starting in version 8.0.0 and prior to versions 8.18.10, 10.7.0, and 12.3.0, Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Versions 8.18.10, 10.7.0, and 12.3.0 contains a...

Return values of approve() not checked

Lines of code 321, 215, 184, 450, 761, 217, 157, 234, 339, 386https://github.com/Tapioca-DAO/t...

Unsafe use of approve() with IERC20

Lines of code 321, 215, 184, 450, 761, 217, 157, 234, 339, 386https://github.com/Tapioca-DAO/t...

Umbraco Security Breach

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. Umbraco suffers from a security vulnerability that stems from the fact that a backend user with send approval privileges but no publish privileges can publish under certain circumstances...

Unbounded Approval

Lines of code Vulnerability details Impact The adapter may approve an unlimited amount of tokens to be spent by the Ocean protocol and the Curve pool, which could be risky if those contracts are compromised. Proof of Concept The adapter may approve an unlimited amount of tokens to be spent by the...

Insecure and Inflexible Forwarder Approval Mechanism (Full Access Grant)

Lines of code Vulnerability details Impact The current implementation of the onlyApprovedForwarder modifier in the Ocean smart contract has several negative impacts: 1. Security Risk: Users are exposed to a significant security risk if their forwarder is compromised. An attacker can exploit full...

Return values of approve() not checked

Lines of code 321, 215, 184, 450, 761, 217, 157, 234, 339, 386https://github.com/Tapioca-DAO/t...

NFT Claiming Issue Due to Lacking Ownership

Lines of code Vulnerability details Impact The vulnerability in the AuctionDemo contract has a significant impact on the ability of auction winners to claim their NFTs. The root cause of the vulnerability is that the AuctionDemo contract fails to check whether it owns or has approval to transfer...

A single host can approve a proposal for all other hosts in the Party

Lines of code Vulnerability details Summary A single host can approve a proposal by transferring the host role to dummy accounts and voting again to increment the number of approvals. Impact When a proposal is created in a Party, the number of active hosts is snapshotted in the proposal state...

CVE-2023-4379

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated...

CVE-2023-4379

GitLab Enterprise Edition vulnerability CVE-2023-4379: Code owner approval was not removed from merge requests when the target branch was updated. Affected GitLab EE versions are 15.3–16.2.8, 16.3–16.3.5, and 16.4–16.4.1. Consequence is improper merge request handling potentially enabling unautho...

CVE-2023-4379 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated...

CVE-2023-4379

Removed by vendor...

Gitlab -- Vulnerabilities

Gitlab reports: Disclosure of CI/CD variables using Custom project templates GitLab omnibus DoS crash via OOM with CI Catalogs Parsing gitlab-ci.yml with large string via timeout input leads to Denial of Service DoS - Blocking FIFO files in Tar archives Titles exposed by service-desk template...