16957 matches found
PT-2023-32082 · Unknown · Infinispan
Name of the Vulnerable Software and Affected Versions: Infinispan affected versions not specified Description: A flaw was found in the serialization of cache configurations to XML, JSON, or YAML formats, which can contain credentials such as those used in JDBC stores with connection pooling or...
PT-2023-31073 · Unknown · Saiful Islam Add To Cart Text Changer/Customize Button
Name of the Vulnerable Software and Affected Versions: Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon versions n/a through 2.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...
GHSA-P6CP-6R35-32MH Solr search discloses password hashes of all users
Impact The Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. To reproduce, it is sufficient to search for propertyvalue:? AND reference:.password and then deselect the "Documen...
Solr search discloses password hashes of all users
Impact The Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. To reproduce, it is sufficient to search for propertyvalue:? AND reference:.password and then deselect the "Documen...
GHSA-QQHQ-8R2C-C3F5 nvdApiKey is logged in debug mode
Summary The value of nvdApiKey configuration parameter is logged in clear text in debug mode. Details The NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode. Expecting the same behavior as for several password configurations: just print Note that...
nvdApiKey is logged in debug mode
Summary The value of nvdApiKey configuration parameter is logged in clear text in debug mode. Details The NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode. Expecting the same behavior as for several password configurations: just print Note that...
CVE-2023-50719
XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...
Security Bulletin: IBM Db2 Mirror for i is vulnerable to an attacker obtaining sensitive information due to a vulnerability in web browser clients (CVE-2023-47741).
Summary IBM Db2 Mirror for i GUI is a web browser client interface implementation. The browser implementation could allow sensitive information including passwords to be left in memory which could be viewed using common tools for viewing process information on a PC CVE-2023-47741. IBM Db2 Mirror...
Featured Image from URL (FIFU) < 4.5.4 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape the featured image alt text, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...
CVE-2023-1904
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server...
CVE-2023-1904
CVE-2023-1904 affects Octopus Server. The issue allows the OpenID client secret to be logged in clear text during server configuration. Public records in the provided documents confirm the vulnerability and its association with Octopus Server, but do not specify an official fix or affected versio...
PT-2023-20212 · Zte · Zte Mobile Internet
Name of the Vulnerable Software and Affected Versions: ZTE mobile internet products affected versions not specified Description: The issue is related to a SQL injection vulnerability due to insufficient input validation of the SMS interface parameter. An authenticated attacker could exploit this ...
Medium: python-pillow
Issue Overview: An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw...
Tokens stored in plain text by PaaSLane Estimate Plugin
Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...
Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin
Jenkins OpenId Connect Authentication Plugin stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator...
GHSA-V9W3-34XQ-HRJG Tokens stored in plain text by PaaSLane Estimate Plugin
Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...
Format string
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining...
Jenkins OpenId Connect Authentication Plugin Security Vulnerability
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability ...
(0Day) OpenAI ChatGPT Improper Input Validation Model Policy Bypass Vulnerability
This vulnerability allows remote attackers to bypass policy restictions on affected versions of OpenAI ChatGPT. Authentication is required to exploit this vulnerability. The specific flaw exists within the interface to the ChatGPT-Vision Data model. The issue results from the lack of proper...