CVE-2024-10101

CVE-2024-10101 concerns a stored XSS in binary-husky/gpt_academic v3.83, occurring at the /file endpoint which renders HTML files. Malicious HTML uploads stored on the backend can trigger payload execution in a victim’s browser when the file is accessed, potentially exposing session cookies or ot...

Input Validation

typo3/cms-backend is vulnerable to Input Validation. The vulnerability is due to a lack of proper validation checks on user input, allowing for the manipulation of data saved in the bookmark toolbar and triggering errors that disrupt access to the backend user interface...

PT-2024-31606

Name of the Vulnerable Software and Affected Versions: Picotls versions prior to the latest release Description: The issue arises when parsing a spoofed TLS handshake message, causing picotls to attempt to free the same memory twice. This double free occurs during the disposal of multiple objects...

CVE-2024-47870

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker ca...

CVE-2024-47870

CVE-2024-47870 is a race condition in Gradio’s update_root_in_config function that lets an attacker modify the frontend-backend root URL, enabling redirection of user traffic to a malicious server. This can lead to interception of sensitive data (e.g., credentials, uploaded files) for users conne...

Gradio has a race condition in update_root_in_config may redirect user traffic

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect use...

GHSA-XH2X-3MRM-FWQM Gradio has a race condition in update_root_in_config may redirect user traffic

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect use...

Vault Operators in Root Namespace May Elevate Their Privileges

Summary A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. This vulnerability, identified as CVE-2024-9180, is fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18....

MAL-2024-9128 Malicious code in backend-engineering-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba3d379889155c3bbca462ca410261268a1d3a1a0d824d8108c2e4a9a225e8b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in backend-engineering-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba3d379889155c3bbca462ca410261268a1d3a1a0d824d8108c2e4a9a225e8b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SurrealDB: Improper Authorization in Select Permissions

Due to the order in which permissions were processed, some statements, filters and computations could lead to leaking field values or record contents to users without the required permissions. This behavior could be triggered in different scenarios: - When performing a SELECT operation on a table...

GHSA-FFCV-V6PW-QHRP Denial of Service in TYPO3 Bookmark Toolbar

Problem Due to insufficient input validation, manipulated data saved in the bookmark toolbar of the backend user interface causes a general error state, blocking further access to the interface. Exploiting this vulnerability requires an administrator-level backend user account. Solution Update to...

Denial of Service in TYPO3 Bookmark Toolbar

Problem Due to insufficient input validation, manipulated data saved in the bookmark toolbar of the backend user interface causes a general error state, blocking further access to the interface. Exploiting this vulnerability requires an administrator-level backend user account. Solution Update to...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to insufficient input validation of the data saved in the bookmark toolbar. This can cause a general error state, blocking further access to the interface. Details Denial of Service DoS describes a family of...

Incorrect Authorization

Overview typo3/cms is a free open source Content Management Framework. Affected versions of this package are vulnerable to Incorrect Authorization by exposing restricted items in the backend page tree to be viewed by other users, if the mounts pointed to pages restricted for their user/group or i...

Incorrect Authorization

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Incorrect Authorization by exposing restricted items in the backend page tree to be viewed by other users, if the mounts pointed to pages restricted for their...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization by exposing restricted items in the backend page tree to be viewed by other users, if the mounts pointed to pages restricted for their user/group or if permissions were set to "everybody". Remediation Upgrade...

CVE-2024-47780

TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected...

CVE-2024-47780

TYPO3 CVE-2024-47780 is an information-disclosure vulnerability in the TYPO3 backend page tree. The issue allows backend users to view items for pages they should not access when mounts point to restricted pages or when mounts are absent but pages allow access to “everybody.” The underlying root ...

CVE-2024-47780 Information Disclosure in TYPO3 Page Tree

TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected...