1263 matches found
CVE-2021-43798 Grafana path traversal
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 except for patched versions iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: /public/plugins//, where is the plugin ID for any installe...
CVE-2021-43805
Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential...
Design/Logic Flaw
Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential...
Cross-Site Scripting Vulnerability in @joeattardi/emoji-button
Impact There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2: - A URL for a custom emoji - An i18n string In both of these cases, a value can be crafted such that it can insert a script tag into the page and execute malicious code. Patches This vulnerability...
GitHub Security Lab: [Java] CWE-400: Query to detect uncontrolled thread resource consumption
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [porcupiney.hairs]: [Python] Add Flask Path injection sinks
This bug was reported directly to GitHub Security Lab...
Design/Logic Flaw
Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both that is the same across all installations. In such cases, th...
GitHub Security Lab: [Python]: JWT security-related queries
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Python]: CWE-079: HTTP Header injection
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Go
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Go
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Go
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Javascript
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Javascript
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Javascript
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Go
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Javascript
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: C# : Add query to detect Server Side Request Forgery
This bug was reported directly to GitHub Security Lab...
CVE-2021-41188
Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the .htaccess file will protect against...