PT-2024-1421 · Jenkins +1 · Jenkins Gitlab Branch Source Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier Description: The issue is related to a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL. Th...

PT-2024-19987 · Oracle · Jdk

Name of the Vulnerable Software and Affected Versions: SOFARPC versions prior to 5.12.0 Description: SOFARPC is a Java RPC framework that defaults to using the SOFA Hessian protocol to deserialize received data. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of...

PT-2024-20042 · Unknown · Embedchain

Name of the Vulnerable Software and Affected Versions: Embedchain versions prior to 0.1.57 Description: The issue allows a ReDoS regular expression denial of service via a long string to json.py. This occurs in the JSON loader of Embedchain. Recommendations: For versions prior to 0.1.57, update t...

DEBIAN-CVE-2024-22421

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server...

PT-2024-1832 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.12 Description: The issue concerns a possible path traversal in Apache OFBiz, allowing file inclusion. This vulnerability may enable remote attackers to disclose sensitive information on affected...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via the jsonParseAddNodeArray function in sqlite3.c file. An attacker can potentially lead to a denial of service by passing specially crafted malicious input to the application. Remediation Upgrade sqlite3 to version...

UBUNTU-CVE-2023-50290

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designe...

PT-2024-13215

Name of the Vulnerable Software and Affected Versions fontTools versions 4.28.2 through 4.42.1 Description The subsetting module in fontTools has a XML External Entity Injection XXE vulnerability, allowing an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts containing a S...

CVE-2015-10128 rt-prettyphoto Plugin rt-prettyphoto.php royal_prettyphoto_plugin_links cross site scripting

A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royalprettyphotopluginlinks of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgradin...

PT-2023-31917 · Unknown · Winter Cms

Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.4 Description: The issue concerns a Local File Inclusion vulnerability in Winter CMS, a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can...

PT-2023-25844 · Pexip · Pexip Infinity

Name of the Vulnerable Software and Affected Versions: Pexip Infinity versions prior to 32 Description: The issue allows for Webapp1 XSS via preconfigured links. Recommendations: For versions prior to 32, update to version 32 or later to resolve the issue...

PT-2023-31513 · Medusa · Medusa

Name of the Vulnerable Software and Affected Versions: Medusa versions prior to 1.0.19 Description: Medusa is an automatic video library manager for TV shows. The issue is related to unauthenticated blind server-side request forgery SSRF. The testslack request handler in...

PT-2023-9150 · Owasp · Owasp Antisamy .Net

Name of the Vulnerable Software and Affected Versions: OWASP AntiSamy .NET versions prior to 1.2.0 Description: The issue is related to a mutation cross-site scripting mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. This vulnerability can be exploited when the...

SUSE CVE-2023-6891

A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncontrolled search path. An attack has to be approached locally...

PT-2023-32793 · Kalcaddle · Kodexplorer

Name of the Vulnerable Software and Affected Versions: kalcaddle KodExplorer versions up to 4.51.03 Description: A critical vulnerability has been found in kalcaddle KodExplorer, affecting an unknown function of the file plugins/webodf/app.php. This issue leads to server-side request forgery and...

PYSEC-2023-278

MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in file.py Users should use MindsDB's staging branch or v23.11.4.1, which contain a fix for the issue...

PT-2023-32723 · Linkding · Linkding

Name of the Vulnerable Software and Affected Versions: linkding version 1.23.0 Description: A vulnerability has been found in linkding, where the manipulation of the argument q leads to cross-site scripting. This issue can be exploited remotely. The vendor was contacted and responded...

SUSE CVE-2023-49284

fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than...

UBUNTU-CVE-2023-49297

PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, o...

UBUNTU-CVE-2023-49288

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with...