CVE-2024-24774

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues...

PT-2024-20552

Name of the Vulnerable Software and Affected Versions Mattermost Jira Plugin versions prior to 4.0.0-rc1 Mattermost versions up to 8.1.7 Description The Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created t...

CVE-2024-24774: Incorrect Authorization

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues...

HTML Injection

grumpydictator/firefly-iii is vulnerable to HTML Injection. The vulnerability is caused due to improper sanitization in webhooks features. This allows an attacker to inject malicious HTML content by submitting specially crafted input...

Wordfence Intelligence Weekly WordPress Vulnerability Report (December 18, 2023 to December 31, 2023)

Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now! Over the last two weeks, there were 263 vulnerabilities disclosed in 217 WordPress Plugins and 3 WordPress themes that have been added to the...

Firefly III allows webhooks HTML Injection.

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

GHSA-VWV2-9WCJ-64VX Firefly III allows webhooks HTML Injection.

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Design/Logic Flaw

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075: Improper Neutralization of Input During Web Page Generation

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Firefly III Security Vulnerability

Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III before 6.1.1, which stems from allowing webhooks HTML injection...

CVE-2024-22075

Firefly III before 6.1.1 allows HTML Injection via webhooks due to improper sanitization in webhook handling. Affected product: Firefly III (web application). Root cause: inadequate sanitization of webhook inputs leading to HTML injection. Impact: potential exposure/impact limited to confidential...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

PT-2024-19186 · Unknown · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: Firefly III versions prior to 6.1.1 Description: The issue allows for HTML injection in webhooks. It is related to a Client-Side Path Traversal CSPT vulnerability, which can be used to control data that was assumed to be uncontrollable. This...

HackerOne: Server Side Request Forgery (SSRF) in webhook functionality

Server Side Request Forgery SSRF vulnerability found in webhook functionality. Attacker able to bypass anti-SSRF protections by using IPv6 address mapped to IPv4. This allowed unauthorized access to internal AWS EC2 metadata instance...

Denial Of Service (DoS)

@octokit/webhooks is vulnerable to Denial Of Service DoS. The vulnerability is caused by a lack of exception handling in the verifyAndReceive method within src/verify-and-receive.ts. This method internally calls another method verify which throws an exception which remains unhandled. This uncaugh...

CVE-2023-50728

An uncaught exception vulnerability was found in octokit webhooks. An error may be undefined in some cases, and the resulting request can cause an uncaught exception that ends the nodejs process...

@git-filesystem/github (>=0.0.0, <=0.0.1), git-filesystem (>=0.0.0, <=0.0.1) potentially affected by CVE-2023-50728 via @octokit/webhooks (10.1.3)

@octokit/webhooks NPM version 10.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @octokit/webhooks and may be impacted: - @git-filesystem/github =0.0.0, =0.0.0, =0.0.1 Source cves: CVE-2023-50728 Source advisory: OSV:GHSA-PWFR-8PQ7-X9QV...