13466 matches found
PT-2023-29641 · Frigate · Frigate
Name of the Vulnerable Software and Affected Versions: Frigate versions prior to 0.13.0 Beta 3 Description: Frigate is an open source network video recorder. An unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate, which can lead to...
Frigate Cross-Site Request Forgery Vulnerability
Frigate is a complete local NVR designed for home assistants with AI object detection from the individual developer Blake Blackshear. A cross-site request forgery vulnerability exists in Frigate versions prior to 0.13.0 Beta 3, which stems from a cross-site request forgery CSRF vulnerability in t...
Information Disclosure
apache-airflow is vulnerable to Information Disclosure. The vulnerability is found in the configendpoint.py due to the fact that conf.getboolean"webserver", "exposeconfig" handles only the boolean cases and does not properly handle the case of non-sensitive-only. This oversight enables an...
AZL-39958 CVE-2023-5752 affecting package python3 for versions less than 3.12.3-1
When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how and which...
CVE-2023-46542
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig...
CVE-2023-46542
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig...
Server Side Request Forgery (SSRF)
ethyca-fides is vulnerable to Server Side Request Forgery. The vulnerability arises due to application's inability to perform validation against access of internal resources. A specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems...
Information Disclosure
ethyca-fides is vulnerable to Information Disclosure. The vulnerability is due roles.py as it grants the CONFIGREAD scope to roles other than the owner, specifically the VIEWER and VIEWERANDAPPROVER roles. This allows Admin UI users with roles lower than the owner role to retrieve sensitive confi...
Malicious code in envision-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e466892f76c4ace03350c7ce2ac6600e0ec4196b1d0bc3dea64be89cf7ffcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8401 Malicious code in envision-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e466892f76c4ace03350c7ce2ac6600e0ec4196b1d0bc3dea64be89cf7ffcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
TOTOLINK X2000R 缓冲区错误漏洞
TOTOLINK X2000R Gh is a WiFi 6 router from China's Gion Electronics TOTOLINK, which supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability that stems from the formMeshUploadConfig...
PT-2023-30072 · Totolink · Totolink X2000R
Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web Description: A stack overflow issue was discovered via the function formMeshUploadConfig. This issue may allow for exploitation, potentially leading to unintended consequences. However, no...
CVE-2023-5752
When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how and which...
CVE-2023-46125 Fides Information Disclosure Vulnerability in Config API Endpoint
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The...
CVE-2023-46125 Fides Information Disclosure Vulnerability in Config API Endpoint
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The...
GHSA-RJXG-RPG3-9R89 Fides Information Disclosure Vulnerability in Config API Endpoint
Impact The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the...
PT-2023-29858
Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1 Description The Fides webserver API allows users to retrieve its configuration using the GET api/v1/config endpoint. The configuration data is filtered to suppress most sensitive configuration information before ...
PT-2023-29857
Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1 Description The Fides web application is vulnerable to a Server-Side Request Forgery SSRF attack. This occurs when a malicious user uploads a specially crafted YAML dataset and config file as a ZIP file, allowing...
PT-2023-21973 · Zscaler · Zscaler Client Connector For Windows
Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector for Windows versions prior to 4.1 Description: The issue allows a malicious user to execute code as a privileged user by replacing a folder where the Zscaler Client Connector for Windows writes or deletes a...
