16963 matches found
CVE-2024-35232 github.com/huandu/facebook may expose access_token in error message
github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...
CVE-2021-47543
REJECT This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Pug allows JavaScript code execution if an application accepts untrusted input
Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would...
Cross-Site Request Forgery (CSRF)
ezsystems/ezplatform is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the CSRF protection which is not enabled by default., which allows attackers to perform unauthorized actions by exploiting the inactive CSRF token...
BELL-CVE-2024-36011
Bulletin has no description...
BELL-CVE-2024-36012
Bulletin has no description...
BELL-CVE-2024-36013
Bulletin has no description...
CVE-2023-6502 Inefficient Regular Expression Complexity in GitLab
A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page...
Code Injection
litellm is vulnerable to Code Injection. The vulnerability is due to unsafe usage of the eval function in the litellm.getsecret method, where untrusted data is passed to eval without sanitization...
Remote Code Execution (RCE)
passbolt/passboltapi is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper input sanitization during the server's PGP key generation, allowing users to inject shell code during installation...
Authentication Bypass
pusher/pusher-php-server is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of the channel name and socket ID, which allows malicious end-users to forge access to unauthorized private channels...
BELL-CVE-2023-52876
Bulletin has no description...
BELL-CVE-2023-52877
Bulletin has no description...
BELL-CVE-2023-52872
Bulletin has no description...
BELL-CVE-2023-52870
Bulletin has no description...
BELL-CVE-2023-52873
Bulletin has no description...
BELL-CVE-2023-52869
Bulletin has no description...
BELL-CVE-2023-52874
Bulletin has no description...