1610 matches found
CVE-2023-24824
creationtimestamp| type| source ---|---|--- 2023-03-31 19:16:06+00:00| published-proof-of-concept| https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh 2026-07-13 22:00:17+00:00| seen| https://t.me/GithubRedTeam/91154 2026-07-13 22:00:17+00:00| seen|...
X-Skipper-Proxy v0.13.237 - Server Side Request Forgery Vulnerability
Exploit Title: X-Skipper-Proxy v0.13.237 - Server Side Request Forgery SSRF Exploit Author: Hosein Vita & Milad Fadavvi Vendor Homepage: https://github.com/zalando/skipper Software Link: https://github.com/zalando/skipper Version: v0.13.237 Tested on: Linux CVE: CVE-2022-38580 Summary: Skipper...
CVE-2023-28426
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: GHSA-xrqq-wqh4-5hg2. Reason: Further investigation showed that this CVE was assigned in error. Notes: See https://github.com/darylldoyle/svg-sanitizer/issues/88 for a technical discussion...
GHSA-XM67-587Q-R2VW wasmtime vulnerable to miscompilation of `i8x16.select` with the same inputs on x86_64
Impact Wasmtime's code generation backend, Cranelift, has a bug on x8664 platforms for the WebAssembly i8x16.select instruction which will produce the wrong results when the same operand is provided to the instruction and some of the selected indices are greater than 16. There is an off-by-one...
Nextcloud: Responsive Server-side Request Forgery (SSRF)
Vulnerability description not provided...
D-Link DIR-878 <= 1.30B08 Multiple Command Injection Vulnerabilities
D-Link DIR-878 devices are prone to multiple command injection vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
IPFS go-bitfield vulnerable to DoS via malformed size arguments
Impact When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happen when the size is a not a multiple of 8 or is negative. There were already a note in the NewBitfield documentation: Panics if size is not a multiple ...
CVE-2023-24816
creationtimestamp| type| source ---|---|--- 2023-02-10 09:23:53+00:00| published-proof-of-concept| https://github.com/ipython/ipython/security/advisories/GHSA-29gw-9793-fvw7...
go.uuid has Predictable UUID Identifiers
CVE Description for go.uuid A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker. Updat...
Code injection
Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue...
CVE-2022-25901
creationtimestamp| type| source ---|---|--- 2023-01-18 06:31:03+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-h452-7996-h45h...
GHSA-3244-8MFF-W398 Reflected XSS in Gotify's /docs via import of outdated Swagger UI
Impact Gotify exposes an outdated instance of the Swagger UI API documentation frontend at /docs which is susceptible to reflected XSS attacks when loading external Swagger config files. Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a rendering XSS...
Reflected XSS in Gotify's /docs via import of outdated Swagger UI
Impact Gotify exposes an outdated instance of the Swagger UI API documentation frontend at /docs which is susceptible to reflected XSS attacks when loading external Swagger config files. Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a rendering XSS...
FreeRDP < 2.8.1 Multiple Vulnerabilities
FreeRDP is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Updated php-pear-CAS packages fix security vulnerability
This update fixes a vulnerability in this lib. For details see refererenced github advisory...
Discourse < 2.8.11 Multiple Vulnerabilities
Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...
Nextcloud Server < 23.0.9, < 24.0.5 Multiple Information Disclosure Vulnerabilities (GHSA-8f3p-rcm5-mrg3, GHSA-qpf5-jj85-36h5)
Nextcloud Server is prone to multiple information disclosure vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
parse-server's session object properties can be updated by foreign user if object ID is known
Impact A foreign user can write to the session object of another user if the session object ID is known. For example, a foreign user can assign the session object to their own user by writing to the user field and then read any custom fields of that session object. Note that assigning a session t...
GHSA-6W4Q-23CF-J9JP parse-server's session object properties can be updated by foreign user if object ID is known
Impact A foreign user can write to the session object of another user if the session object ID is known. For example, a foreign user can assign the session object to their own user by writing to the user field and then read any custom fields of that session object. Note that assigning a session t...