Design/Logic Flaw

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. versions of Discourse prior to 2.8.9, and prior to 2.9.0.beta10, contain an input validation error vulnerability that could be exploited by an attacker to add large text load...

PT-2022-24828 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.9.0.beta5 through 2.9.0.beta9 Description: The issue arises when an incomplete quote generates a JavaScript error, potentially crashing the current page in the browser. This occurs in certain cases and is related to how t...

GHSA-Q4Q5-C5CV-2P68 Vuetify Cross-site Scripting vulnerability

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the 'eventName' function within the VCalendar component...

CVE-2021-4178

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

CVE-2021-4178

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

Mealie 代码问题漏洞

Mealie is a self-hosted recipe manager and meal planner from an individual developer in Hayden, USA. A security vulnerability exists in Mealie version 1.0.0beta3, which stems from the fact that it does not terminate download tokens after a user logs out leading to an attacker being able to perfor...

CVE-2022-25228

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via...

CandidATS SQL注入漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 Beta that stems from allowing authenticated users to inject SQL queries via the userID parameter...

PT-2022-17167 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Beta Description: The issue allows an authenticated user to inject SQL queries through specific API endpoints, including '/index.php?m=settings&a=show' via the userID parameter, '/index.php?m=candidates&a=show' via the...

CVE-2022-34618

A stored cross-site scripting XSS vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the recipe description text field...

PT-2022-20594 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse affected versions not specified Description: Discourse is an open source discussion platform. In affected versions, an email activation route can be abused to send mass spam emails. A fix has been included in the latest stable, beta...

Important: Red Hat Security Advisory: container-tools:rhel8 security and bug fix update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

CVE-2022-2290

Cross-site Scripting XSS - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta...

CVE-2022-2290

Cross-site Scripting XSS - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta...

ERPNext 跨站脚本漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A cross-site scripting vulnerability exists in ERPNext versions v13.0.0-beta.13 through v13.30.0, which can be exploited by an attacker to conduct an account takeover attack with a low-privileged user...

Malicious code in @tekion/beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25635e252b9808c78842badaf5878dca711e8678777c82f2327a3561c58a7d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-627 Malicious code in @tekion/beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25635e252b9808c78842badaf5878dca711e8678777c82f2327a3561c58a7d7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4870 Malicious code in noblox.js-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 332a81ed84651ca22b9a949cc938519334d55fc1b9a8fce6a5b123de2098ef96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...