PT-2023-18680 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 Discourse version 3.1.0.beta2 and earlier Description: Discourse is an open source platform for community discussion. The issue is related to Allocation of Resources Without Limits or Throttling, where a...

PT-2023-1227 · Vim +8 · Vim +8

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.0.1225 Description: The issue is related to a heap-based buffer overflow in the Vim text editor, specifically affecting functions such as same leader and utfc ptr2len. This can allow an attacker to execute arbitrary co...

DEBIAN-CVE-2023-22742

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificatecheck field of libgit2's gitremotecallbacks...

CVE-2023-22726 Unrestricted file upload leading to privilege escalation in act

act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege...

CVE-2023-22458 Integer overflow in multiple Redis commands can lead to denial-of-service

Redis is an in-memory database that persists on disk. Authenticated users can issue a HRANDFIELD or ZRANDMEMBER command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not...

PT-2023-18702 · Ruby +5 · Ruby +5

Name of the Vulnerable Software and Affected Versions: Active Support versions prior to 6.1.7.1 Active Support versions prior to 7.0.4.1 Description: The issue is related to insufficient input validation in the Inflector.underscore method, which can lead to a regular expression based DoS...

PT-2023-18703

Name of the Vulnerable Software and Affected Versions GlobalID versions 0.2.1 through 1.0.0 Rails versions 7.0.0 through 7.0.4 Description A ReDoS based DoS vulnerability in GlobalID could allow an attacker to cause the regular expression engine to take an unexpected amount of time with a careful...

CVE-2022-23521

CVE-2022-23521 affects Git. The issue arises from parsing gitattributes, where very large path patterns or attribute names can trigger integer overflows, leading to arbitrary heap reads/writes and potentially remote code execution. Git’s handling of long lines (>2KB) in gitattributes (from fil...

CVE-2023-22731 Improper Control of Generation of Code in Twig rendered views in shopware

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment without the Sandbox extension, it is possible to refer to PHP functions in twig filters like map, filter, sort. This allows a template to call any global PHP function and thus execute arbitra...

CVE-2023-22734 Improper Input Newsletter subscription option validation in shopware

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This...

DEBIAN-CVE-2023-22727

CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit and Cake\Database\Query::offset methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to...

CVE-2023-22499 Interactive permission prompt spoofing in Deno

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. A malicious program could clear the...

UBUNTU-CVE-2022-23521

Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a .gitattributes file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this...

Denial of Service (DoS)

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Denial of Service DoS when a user supplies an excessively long value for the title field of an article and convinces another user to access it. Detail...

PT-2023-9869 · Jianlinwei · Cool-Php-Captcha

Name of the Vulnerable Software and Affected Versions: jianlinwei cool-php-captcha versions up to 0.2 Description: A problematic vulnerability was found in the example-form.php file, where the manipulation of the captcha argument with the input %3Cscript%3Ealert1%3C/script%3E leads to cross-site...

CVE-2022-46176 Cargo did not verify SSH host keys

Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle MITM attacks. This vulnerability has been assigned...

CVE-2015-10039

A vulnerability was found in dobos domino. It has been rated as critical. Affected by this issue is some unknown functionality in the library src/Complex.Domino.Lib/Lib/EntityFactory.cs. The manipulation leads to sql injection. Upgrading to version 0.1.5524.38553 is able to address this issue. Th...

CVE-2023-22469 Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There ar...

PT-2023-18520 · Nextcloud · Deck

Name of the Vulnerable Software and Affected Versions: Nextcloud app Deck versions prior to 1.8.2 Description: The issue affects Deck, a kanban style organization tool integrated with Nextcloud, used for personal planning and project organization for teams. When getting the reference preview for...

Design/Logic Flaw

Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. The communication between GitOps...