14267 matches found
CVE-2023-34249 benjjvi/PyBB may send unsanitized request to SQL database
benjjvi/PyBB is an open source bulletin board. Prior to commit dcaeccd37198ecd3e41ea766d1099354b60d69c2, benjjvi/PyBB is vulnerable to SQL Injection. This vulnerability has been fixed as of commit dcaeccd37198ecd3e41ea766d1099354b60d69c2. As a workaround, a user may be able to update the software...
Smart commit action do not respect user permission for Comment actions
h3. Summary When executing a smart commit for adding a comment as per Processing issues with Smart Commits|https://confluence.atlassian.com/jirasoftwareserver0904/processing-issues-with-smart-commits-1188765783.html, it is not failing even if the user does not have permission for the requested...
Exploit for SQL Injection in Osgeo Geoserver
CVE-2023-25157-checker A script, written in golang. POC for CV...
Python 3.12.0 Pre-Releases Multiple UAF Vulnerabilities - Windows
Python is prone to multiple use-after-free UAF vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...
CVE-2023-1428
There exists an vulnerability causing an abort to be called in gRPC. The following headers cause gRPC's C++ implementation to abort when called via http2: te: x x != trailers :scheme: x x != http, https grpclbclientstats: x x == anything On top of sending one of those headers, a later header must...
CVE-2023-1428 Denial-of-Service in gRPC
There exists an vulnerability causing an abort to be called in gRPC. The following headers cause gRPC's C++ implementation to abort when called via http2: te: x x != trailers :scheme: x x != http, https grpclbclientstats: x x == anything On top of sending one of those headers, a later header must...
GitHub: Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code Execution
A vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling due to an incorrect diff comparison in re-opened pull requests. This affected all versions of GitHub Enterprise Server and was fixed in newer releases...
CVE-2023-34112
JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the bytedeco/javacpp-presets use the github.event.headcommit.message parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection...
PT-2023-24684 · Unknown · Javacpp Presets
Name of the Vulnerable Software and Affected Versions: JavaCPP Presets versions prior to 1.5.9 Description: The issue concerns the insecure use of the github.event.head commit.message parameter in JavaCPP Presets, leading to a command injection vulnerability due to string interpolation. No...
RenderDoc 1.26 Local Privilege Escalation / Remote Code Execution Vulnerabilities
LPE and RCE in RenderDoc: CVE-2023-33865, CVE-2023-33864, CVE-2023-33863 ======================================================================== Contents ======================================================================== Summary CVE-2023-33865, a symlink vulnerability in /tmp/RenderDoc -...
CVE-2023-33595
CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function asciidecode at /Objects/unicodeobject.c...
Microweber Cross-site Scripting vulnerability
Microweber 1.3.4 and prior is vulnerable to stored cross-site scripting via an alert on the Editing page. This issue is fixed in commit 42efa981a2239d042d910069952d6276497bdcf1...
GHSA-FQCV-RFP6-WV92 Microweber Cross-site Scripting vulnerability
Microweber 1.3.4 and prior is vulnerable to stored cross-site scripting via an alert on the Editing page. This issue is fixed in commit 42efa981a2239d042d910069952d6276497bdcf1...
Design/Logic Flaw
An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address...
CVE-2023-34103
Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting XSS when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are...
Input validation
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes...
CVE-2023-34103 Stored XSS (Cross Site Scripting) in html content based fields of avo
Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting XSS when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are...
CVE-2023-34103 Stored XSS (Cross Site Scripting) in html content based fields of avo
Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting XSS when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are...
Design/Logic Flaw
ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can...