9845 matches found
GHSA-27HP-XHWR-WR2M vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2024-56337 vulnerabilities
Vulnerabilities for packages: thingsboard...
CVE-2024-56337
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be...
CVE-2024-12678
Nomad Community and Nomad Enterprise "Nomad" allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16...
CVE-2024-56327
pyrage is a set of Python bindings for the rage file encryption library age in Rust. pyrage uses the Rust age crate for its underlying operations, and age is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to pyrage for the versions specified in this advisory. S...
GHSA-PR98-23F8-JWXV vulnerabilities
Vulnerabilities for packages: akhq, management-api-for-apache-cassandra-5.0, cassandra-reaper, dependency-track, tez, sonarqube-10, trino, thingsboard, kserve-modelmesh, sonarqube, cassandra, sonar-scanner-cli, apache-nifi...
GHSA-6V67-2WR5-GVF4 vulnerabilities
Vulnerabilities for packages: akhq, management-api-for-apache-cassandra-5.0, cassandra-reaper, dependency-track, tez, sonarqube-10, trino, thingsboard, kserve-modelmesh, sonarqube, cassandra, sonar-scanner-cli, apache-nifi...
CVE-2024-38819
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...
CVE-2024-12801 vulnerabilities
Vulnerabilities for packages: akhq, management-api-for-apache-cassandra-5.0, cassandra-reaper, dependency-track, tez, sonarqube-10, trino, thingsboard, kserve-modelmesh, sonarqube, cassandra, sonar-scanner-cli, apache-nifi...
CVE-2024-12798
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program...
CVE-2024-12798
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program...
CVE-2024-9102
phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value CSV file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet...
CVE-2024-12695 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2024-12693 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2024-12692 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-32GQ-X56H-299C age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or plugin.NewRecipient APIs. ...
GHSA-32GQ-X56H-299C vulnerabilities
Vulnerabilities for packages: flux-kustomize-controller, litestream, age, sops, ksops, chezmoi...
age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or plugin.NewRecipient APIs. ...
GHSA-4FG7-VXC8-QX5W rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or to the following age APIs when the plugin feature flag is enabled: -...