Path traversal

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

CVE-2023-3765 Absolute Path Traversal in mlflow/mlflow

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

CVE-2023-3765

MLflow (mlflow/mlflow) prior to version 2.5.0 contains an Absolute Path Traversal vulnerability. The issue arises in an MLflow repository and can lead to unauthorized access to sensitive information stored on the server. According to the connected sources, the affected component is mlflow/mlflow’...

CVE-2023-3765 Absolute Path Traversal in mlflow/mlflow

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

CVE-2023-3700 Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments

Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

CVE-2023-3696

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

Code injection

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

CVE-2023-3696

CVE-2023-3696 affects the GitHub repository automattic/mongoose, with the vulnerability present in versions before 7.3.4. The root cause is a prototype pollution flaw in the code path used for object merging. Exploitation details are not provided in the supplied documents, but CVSS metrics indica...

CVE-2023-3696 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

CVE-2023-3696 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0...

Admidio vulnerable to Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10...

CVE-2023-3692

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10...

CVE-2023-3692 Unrestricted Upload of File with Dangerous Type in admidio/admidio

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10...

Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10...

Sql injection

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24...

CVE-2023-3672 Cross-site Scripting (XSS) - DOM in plaidweb/webmention.js

Cross-site Scripting XSS - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5...

CVE-2023-3668 Improper Encoding or Escaping of Output in froxlor/froxlor

Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21...

PT-2023-25676 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.21 Description: The issue is related to improper encoding or escaping of output in the GitHub repository froxlor/froxlor. Recommendations: For versions prior to 2.0.21, update to version 2.0.21 or later to resolv...

Cross-Site Scripting (XSS)

github.com/mlogclub/bbs-go is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject and execute malicious javascript on victim's browser via a crafted payload to the comment...