4436 matches found
Lack of check could cause lose of user funds
Lines of code Vulnerability details Impact The increaseamount function is currently missing check for attachments and voted. Any amount provided will get added to existing amount. The increased amount will get stuck during withdraw if attachmentstokenId != 0 or votedtokenId Proof of Concept 1. Us...
org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2021-22137 via org.elasticsearch:elasticsearch (0.6.0)
org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2021-22137 Source advisory:...
org.elasticsearch:elasticsearch-analysis-icu (0.11.0), org.elasticsearch:elasticsearch-cloud-aws (0.11.0) +7 more potentially affected by CVE-2020-7021 via org.elasticsearch:elasticsearch (0.11.0)
org.elasticsearch:elasticsearch MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.11.0 - org.elasticsearch:elasticsearch-cloud-aws...
org.elasticsearch:elasticsearch-analysis-icu (0.7.0), org.elasticsearch:elasticsearch-client-groovy (0.7.0) +3 more potentially affected by CVE-2020-7021 via org.elasticsearch:elasticsearch (0.7.0)
org.elasticsearch:elasticsearch MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.7.0 - org.elasticsearch:elasticsearch-client-groov...
org.elasticsearch:elasticsearch-analysis-icu (0.7.1), org.elasticsearch:elasticsearch-client-groovy (0.7.1) +3 more potentially affected by CVE-2020-7021 via org.elasticsearch:elasticsearch (0.7.1)
org.elasticsearch:elasticsearch MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.7.1 - org.elasticsearch:elasticsearch-client-groov...
org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2020-7021 via org.elasticsearch:elasticsearch (0.6.0)
org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2020-7021 Source advisory:...
GHSA-XJMX-CPRH-646R MantisBT unauthorized users able to access private files
An issue was discovered in filedownload.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the supposedly private attachments linked to these notes by accessing the corresponding file download URL directly...
org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2020-7019 via org.elasticsearch:elasticsearch (0.6.0)
org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2020-7019 Source advisory:...
Mattermost Server is vulnerable to XSS through author_link field in Slack attachments
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment...
GHSA-498J-WXWW-J897 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment...
Moodle Email media URL tokens were not checking for user status
A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token...
GHSA-774Q-WFCP-VC2Q Moodle Email media URL tokens were not checking for user status
A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token...
phpBB Cross-Site Request Forgery (CSRF)
Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments...
org.apache.nifi:nifi-media-nar (>=0.7.0, <=1.4.0), org.apache.nifi:nifi-media-processors (>=0.7.0, <=1.4.0) +15 more potentially affected by CVE-2019-12415 via org.apache.poi:poi (3.12-beta1)
org.apache.poi:poi MAVEN version 3.12-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi and may be impacted: - org.apache.nifi:nifi-media-nar =0.7.0, =0.7.0, =2.6.0, =2.7.0 - uk.nhs.ciao:ciao-docs-parser 0.1 and more Source cves:...
org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2019-7614 via org.elasticsearch:elasticsearch (0.6.0)
org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2019-7614 Source advisory:...
org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2015-3337 via org.elasticsearch:elasticsearch (0.6.0)
org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2015-3337 Source advisory:...
org.elasticsearch:elasticsearch-analysis-icu (0.10.0), org.elasticsearch:elasticsearch-client-groovy (0.10.0) +4 more potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.10.0)
org.elasticsearch:elasticsearch MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.10.0 -...
org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2014-3120 via org.elasticsearch:elasticsearch (0.6.0)
org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2014-3120 Source advisory:...