5872 matches found
GHSA-HF9H-VV4M-2F33 vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-RRGP-C2W8-6VG6 vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-584M-7R4M-8J6V vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-J664-QHH4-HPF8 vulnerabilities
Vulnerabilities for packages: jenkins...
CVE-2023-27490
NextAuth.js is an open source authentication solution for Next.js applications. next-auth applications using OAuth provider versions before v4.20.1 have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social...
Authorization
NextAuth.js is an open source authentication solution for Next.js applications. next-auth applications using OAuth provider versions before v4.20.1 have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social...
CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
NextAuth.js is an open source authentication solution for Next.js applications. next-auth applications using OAuth provider versions before v4.20.1 have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social...
CVE-2023-27490
NextAuth.js (for Next.js) versions before 4.20.1 are affected. A partial OAuth session failure lets a network observer or social engineer modify the authorization URL to bypass CSRF checks, potentially logging in as the victim. The issue arises from missing/compromised state, PKCE, and nonce hand...
CVE-2023-27490 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
NextAuth.js is an open source authentication solution for Next.js applications. next-auth applications using OAuth provider versions before v4.20.1 have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the victim's network or who is able to social...
GHSA-WJ6X-HCC2-F32J vulnerabilities
Vulnerabilities for packages: consul...
GHSA-FF4P-7XRQ-Q5R8 vulnerabilities
Vulnerabilities for packages: wasmtime, zellij...
CVE-2023-27476
OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...
Design/Logic Flaw
OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...
CVE-2023-27476
OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...
CVE-2023-27476
OWSLib (Python) has a vulnerability in its XML parser that does not disable entity resolution, enabling potential arbitrary file reads from attacker-controlled XML payloads across all XML parsing in the codebase. Affected versions prior to 0.28.1; remediation is to upgrade to 0.28.1 or apply the ...
CVE-2023-27476
OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...
XWiki 3.0-milestone-1 < 13.10.10, 14.x < 14.4.5, 14.5.x < 14.8 Incorrect Authorization Vulnerability (GHSA-859x-p6jp-rc2w)
Xwiki is prone to an incorrect authorization vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...
XWiki 13.x < 13.10.11, 14.x < 14.4.7, 14.5.x < 14.10 Privilege Escalation Vulnerability (GHSA-3738-p9x3-mv9r)
Xwiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescripti...
XWiki 3.2-m3 < 13.10.9, 14.x < 14.4.4, 14.5.x < 14.7 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (GHSA-5cf8-vrr8-8hjm)
Xwiki is prone to an exposure of sensitive information to an unauthorized actor vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...