webpack-dev-middleware: lack of URL validation may lead to file leak

A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling...

CVE-2024-4146

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

CVE-2024-4146

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

CVE-2024-4146 Incorrect Authorization in lunary-ai/lunary

In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the checkProjectAccess method within the...

CVE-2024-4146

In Lunary (lunary-ai/lunary) v1.2.13, CVE-2024-4146 describes an incorrect authorization vulnerability in the checkProjectAccess middleware. The vulnerability relies on only verifying organization membership and fails to enforce explicit project-level permissions checked via the account_project t...

PT-2024-29408 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version v1.2.13 Description: The issue is related to an incorrect authorization vulnerability that allows unauthorized users to access and manipulate projects within an organization they should not have access to. This...

sessions (>=0.2.0, <=0.6.0), viz (>=0.1.0-alpha.3, <=0.1.0-alpha.10) +1 more potentially affected by CVE-2024-36400 via nano-id (>=0.1.1, <=0.3.3)

nano-id CARGO version =0.1.1, =0.2.0, =0.1.0-alpha.3, =0.1.0-alpha.5, =0.1.2 Source cves: CVE-2024-36400 Source advisory: OSV:GHSA-9HC7-6W9R-WJ94...

sessions (>=0.2.0, <=0.6.0), viz (>=0.1.0-alpha.3, <=0.1.0-alpha.10) +1 more potentially affected by CVE-2024-36400 via nano-id (>=0.1.1, <=0.3.3)

nano-id CARGO version =0.1.1, =0.2.0, =0.1.0-alpha.3, =0.1.0-alpha.5, =0.1.2 Source cves: CVE-2024-36400 Source advisory: OSV:RUSTSEC-2024-0343...

Oracle WebLogic Server OS Command Injection Vulnerability

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document...

Contributed Rack Middleware and Utilities 安全漏洞

Contributed Rack Middleware and Utilities is a collection of various add-ons for Rack, a Ruby web server interface. A security vulnerability exists in Contributed Rack Middleware and Utilities versions prior to 2.5.0, which stems from unrestricted user-controlled data that is susceptible to...

Important: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update

Migration Toolkit for Applications 7.0.3 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

GO-2024-2813 Some CORS middleware allow untrusted origins in github.com/jub0bs/cors

Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patter...

GO-2024-2812 Some CORS middleware allow untrusted origins in github.com/jub0bs/fcors

Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patter...

Important: Red Hat Security Advisory: AMQ Broker 7.12.0.OPR.1.GA Container Images release and security update

This is the multiarch release of the AMQ Broker 7.12.0 aligned Operator and associated container images on Red Hat Enterprise Linux 8 for the OpenShift Container Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syste...

GHSA-CG34-W3FM-82H3 Duplicate Advisory: Scrapy leaks the authorization header on same-domain but cross-origin redirects

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4qqq-9vqf-3h3f. This link is maintained to preserve external references. Original Description In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only...

CVE-2024-1968

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

PYSEC-2024-258

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

PYSEC-2024-258

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

CVE-2024-1968

In scrapy/scrapy, an issue was identified where the Authorization header is not removed during redirects that only change the scheme e.g., HTTPS to HTTP but remain within the same domain. This behavior contravenes the Fetch standard, which mandates the removal of Authorization headers in...

CVE-2024-1968

CVE-2024-1968 affects Scrapy’s redirect middleware, specifically the _build_redirect_request path, where the Authorization header is not stripped when a redirect downgrades from HTTPS to HTTP within the same domain. This can leak credentials in plaintext during cross-origin-like redirects that ch...