CVE-2023-22736 argo-cd Controller reconciles apps outside configured namespaces when sharding is enabled

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions starting with 2.5.0-rc1 and above, prior to 2.5.8, and version 2.6.0-rc4, are vulnerable to an authorization bypass bug which allows a malicious Argo CD user to deploy Applications outside the configured allowed...

bumsys 代码问题漏洞

bumsys is an open source project called Business Management System by unilogies individual developers. A code issue vulnerability exists in versions prior to bumsys v1.0.3-beta, which stems from the fact that it allows an attacker to upload dangerous types of files without restriction...

PT-2023-18519 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.13 Discourse version 3.0.0.beta16 and earlier in the beta and tests-passed channels Description: The issue allows a maliciously crafted URL to be included in a post to carry out cross-site scripting attacks on...

PT-2023-16284 · Unilogies · Bumsys

Name of the Vulnerable Software and Affected Versions: unilogies/bumsys versions prior to 1.0.3-beta Description: The issue concerns an unrestricted upload of a file with a dangerous type. Recommendations: For versions prior to 1.0.3-beta, update to version 1.0.3-beta or later to resolve the issu...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. A cross-site scripting vulnerability exists in Discourse versions prior to 2.8.13 stable, 3.0.0.beta16 beta, and 3.0.0beta16 tested. An attacker could exploit this...

PT-2023-1610 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 on the stable branch Discourse versions prior to 3.1.0.beta2 on the beta and tests-passed branches Description: The issue is related to the use of a regular expression with inefficient computational complexit...

CVE-2018-25071

A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insertlog of the file wwwroot/ccpwgl/proxy.php. The manipulation of the argument fetch leads to sql injection. Upgrading to version 0.1.59-beta is able to address this...

LMeve SQL注入漏洞

LMeve is the industry manager and contribution tracker for EVE Online. A SQL injection vulnerability exists in roxlukas LMeve versions prior to 0.1.59-beta, which stems from an issue with the function insertlog in the file wwwroot/ccpwgl/proxy.php, where manipulation of the parameter fetch can le...

PT-2023-12731 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 on the stable branch and prior to 2.9.0.beta16 on the beta and tests-passed branches Description: The issue allows users to create posts with a raw body longer than the max length site setting by including...

PT-2023-12730 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 2.9.0.beta16 on the beta and tests-passed branches Description: The issue affects the parsing of posts in Discourse, making it susceptible to regular expressi...

PT-2023-14816 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 on the stable branch and version 2.9.0.beta15 on the beta and tests-passed branches Description: Discourse is an open-source discussion platform. Prior to the specified versions, recipients of a group SMTP...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. An information disclosure vulnerability exists in Discourse version 2.9.0.beta14. An attacker exploited the vulnerability to expose private information...

PT-2023-18510 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 3.0.0.beta16 on the beta and tests-passed branches Description: The issue concerns a cross-site scripting attack through pending post titles, which can be...

PT-2022-28153 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.0-beta1 Description: The issue is related to improper authorization in the GitHub repository froxlor/froxlor. Recommendations: For versions prior to 2.0.0-beta1, update to version 2.0.0-beta1 or later to resolve...

Froxlor 跨站请求伪造漏洞

Froxlor is a lightweight server management software from the Froxlor team. A cross-site request forgery vulnerability exists in Froxlor versions prior to 2.0.0-beta1, which stems from cross-site request forgery CSRF...

Google Takes Gmail Security to the Next Level with Client-Side Encryption

Google on Friday announced that its client-side encryption for Gmail is in beta for Workspace and education customers as part of its efforts to secure emails sent using the web version of the platform. The development comes at a time when concerns about online privacy and data security are at an...

kubernetes-client: Insecure deserialization in unmarshalYaml method

A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML...

CVE-2022-46159: Allocation of Resources Without Limits or Throttling

Discourse is an open-source discussion platform. In version 2.8.13 and prior on the stable branch and version 2.9.0.beta14 and prior on the beta and tests-passed branches, any authenticated user can create an unlisted topic. These topics, which are not readily available to other users, can take u...

CVE-2022-2969

Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname,...

CVE-2022-2969: Improper Limitation of a Pathname to a Restricted Directory

Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory. However, the software does not properly neutralize special elements within the pathname,...