5957 matches found
XWiki < 13.10.6, 14.0 < 14.4 Code Injection Vulnerability (GHSA-2g5c-228j-p52x)
Xwiki is prone to a code injection vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...
GHSA-R7VQ-6425-J94W Python-TUF vulnerable to incorrect threshold signature computation for new root metadata
Impact The function verifyrootselfsigned, introduced in v0.14.0, and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towards the new threshold. That is, any single new root key could theoretically provide enough signatures to meet the...
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 5.7 Problem Due to a parsing issue in upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanis...
Duplicate of GHSA-m77f-652q-wwp4
Duplicate advisory This advisory is a duplicate of GHSA-m77f-652q-wwp4. This link is maintained to preserve external references. Original Description ::fromrequest would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large or infini...
CVE-2022-36056
Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...
CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign
Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...
CVE-2022-36056
Cosign (sigstore) has CVE-2022-36056 affecting verify-blob in versions before 1.12.0. Connected advisories confirm multiple verification bypass issues: (1) a crafted bundle can pass verification even if rekorBundle does not reference the blob; (2) identity flags (certificate email/issuer and GitH...
XWiki 8.0 < 13.10.5, 14.0 < 14.3 User Registration Vulnerability (GHSA-h5j3-5x63-p8jv)
Xwiki is prone to a user registration vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...
XWiki < 13.10.4, 14.0 < 14.2 Authentication Bypass Vulnerability (GHSA-8h89-34w2-jpfm)
Xwiki is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...
GHSA-47m6-46mj-p235: By-passing Cross-Site Scripting Protection in HTML Sanitizer
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 5.7 Problem Due to a parsing issue in upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanis...
MAL-2022-3911 Malicious code in internallib_v900 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b444ce60e2348e602dc655ad88d7db0e56e3c5f7b2678bfa26154dbab981222 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3878 Malicious code in internallib_123 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b1422905ccc2130b6c7069e69a3addae1ef96e39e14de364209f65a2eb6f7ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
XWiki < 13.10.4, 14.0 < 14.2 Information Disclosure Vulnerability (GHSA-599v-w48h-rjrm)
Xwiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...
GHSA-FJ2M-W3WV-X9PR vulnerabilities
Vulnerabilities for packages: trino...
Opencast < 9.10, 10.x < 10.6 Log4j RCE Vulnerability (GHSA-mf4f-j588-5xm8, Log4Shell)
Opencast is prone to a remote code execution RCE vulnerability in the Apache Log4j library dubbed SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...
XWiki 11.3.7 < 13.10.4, 14.0 < 14.2 Privilege Escalation Vulnerability (GHSA-g4h6-qp44-wqvx)
Xwiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescripti...
GHSA-C4R9-R8FH-9VJ2 vulnerabilities
Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...
Grafana Image Renderer Vulnerability (GHSA-2cfh-233g-m4c5)
Grafana is prone to a vulnerability in Grafana Image Renderer. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...