CVE-2024-31994 Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228)

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, an attacker can point the image request to an arbitrarily large file. Mealie will attempt to retrieve this file in whole. If it can be retrieved, it may be stored on the file system in whole leading to possible disk...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner from an individual developer in Hayden, USA. A security vulnerability exists in Mealie versions prior to 1.4.0, which stems from a lack of rate limiting on the endpoint also allows an attacker to generate persistent requests to any target of...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner from an individual developer in Hayden, USA. A security vulnerability exists in Mealie versions prior to 1.4.0, which stems from a safescrapehtml function that utilizes a user-controlled URL to make a request to a remote server, which can be...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner from an individual developer in Hayden, USA. A security vulnerability exists in Mealie versions prior to 1.4.0 that stems from a safescrapehtml function that utilizes a user-controlled URL to make requests to a remote server that are not...

CVE-2024-32474

Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validatesuperuser. An attacker with access to the log data could use...

CVE-2024-32474 Sentry's superuser cleartext password leaked in logs

Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validatesuperuser. An attacker with access to the log data could use...

CVE-2024-32474 Sentry's superuser cleartext password leaked in logs

Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validatesuperuser. An attacker with access to the log data could use...

GHSA-6CJM-4PXW-7XP9 Sentry vulnerable to leaking superuser cleartext password in logs

Impact When authenticating as a superuser to a self-hosted Sentry instance with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validatesuperuser. An attacker with access to the log data could use these leaked credentials to login to the Sentry...

MAL-2024-1269 Malicious code in hosted-lenses-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05c6cf9e3c0564724471422898f07aea9b5234d6c00d38d95441a3fbe18cd004 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hosted-lenses-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05c6cf9e3c0564724471422898f07aea9b5234d6c00d38d95441a3fbe18cd004 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-3505

JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments...

CVE-2024-3505 JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users

JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments...

CVE-2024-3505

CVE-2024-3505 affects JFrog Artifactory Self-Hosted: versions prior to 7.77.3 are vulnerable to information disclosure where a low-privileged authenticated user can read the proxy configuration. The issue does not impact JFrog cloud deployments. Remediation: upgrade to 7.77.3 or later (as stated ...

JFrog Artifactory Self-Hosted 信息泄露漏洞

JFrog Artifactory is an open source, general-purpose Artifact repository manager from Israel's JFrog that supports clustering and high-availability Docker registries, and provides an end-to-end automation solution for tracking artifacts from development to production. An information disclosure...

CVE-2024-31454 PsiTransfer file integrity violation vulnerability

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution. The...

Sunshine 安全漏洞

Sunshine is a Moonlight self-hosted live game host. A security vulnerability exists in Sunshine versions prior to 0.16.0 through 0.18.0 that stems from the presence of a path traversal vulnerability...

Webhood 安全漏洞

Webhood is a self-hosted URL scanner for analyzing phishing and malicious websites. A security vulnerability exists in Webhood version 0.9.0 and prior versions, which stems from a vulnerability that allows an unauthenticated attacker to create an administrator account by sending an HTTP request t...

CVE-2024-27981

The CVE-2024-27981 describes a Command Injection vulnerability in self-hosted UniFi Network Server software (Linux) running UniFi Network Application

CVE-2024-20282

A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an affected device. This vulnerability is due to insufficient protections for a sensitive access token. An attacker could exploit this...

CVE-2024-20282

CVE-2024-20282 — Cisco Nexus Dashboard Privilege Elevation : A vulnerability in Cisco Nexus Dashboard allows an authenticated, local attacker with valid rescue-user credentials to escalate to root. The issue stems from insufficient protections for a sensitive access token, enabling access to reso...