Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer...

jquery-plugin-query-object contains prototype pollution vulnerability

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype...

GHSA-W2HR-3MC8-46GH SaltStack Salt eauth tokens can be used once after expiration

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...

SaltStack Salt eauth tokens can be used once after expiration

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...

SaltStack Salt Improper SSL Certificate Validation

In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated...

GHSA-7J8M-FM49-XGMG MantisBT Incorrect Authorization for bug_revision_view_page.php check

An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bugrevisionviewpage.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential information via the bugnoteid parameter...

GHSA-8C7C-2C8J-3XFP blosc2 heap-based buffer overflow

blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data...

Gitaly Insufficient Session Expiration vulnerability

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. Affected versions are: =1.79.0, =13.4, =13.5, 13.5.2...

aptdaemon Information Disclosure via Improper Input Validation in Transaction class

There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an...

Magento php object injection vulnerability

Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution. A patch SUPEE-11346 is available at Magento Open Source Download Page Release Archive Tab Magento Open Source Patches - 1.x...

TeamPass PHP arbitrary file include vulnerability

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...

MantisBT XSS when uploading an attachment

The projdoceditpage.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting XSS vulnerability, allowing execution of arbitrary code if CSP settings permit it after uploading an attachment with a crafted filename. The code is executed when editing the document...

GHSA-7W6P-RWHG-7H3G Grin Insufficient Validation

Grin through 2.1.1 has Insufficient Validation...

GHSA-69Q7-HWW4-8PJQ phpBB allows CSRF

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships...

GHSA-94Q8-GX29-6MQV Magento Injection vulnerability via email templates

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templates can send malicious SQL queries and obtain access to sensitive information stored in the database...

Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization

A missing permission check in Jenkins CRX Content Package Deployer Plugin prior to version 1.9 in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue is patched in version 1.9...

MantisBT Remote Code Execution

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution...

GHSA-V23G-WJVQ-2FPF MantisBT Remote Code Execution

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution...

Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article Title

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journalarticle/page.jsp in journal/journal-taglib...

GHSA-274W-2J5W-M2XJ Magento 2 Community Edition Information Disclosure

Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...