CVE-2022-24828

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call VcsDriver::getFileContent can have a code injection vulnerability if the user can control the $file or $identifier argument. This leads to a vulnerability on packagist.org for example where...

CVE-2022-24828

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call VcsDriver::getFileContent can have a code injection vulnerability if the user can control the $file or $identifier argument. This leads to a vulnerability on packagist.org for example where...

Missing input validation can lead to command execution in composer

The Composer method VcsDriver::getFileContent with user-controlled $file or $identifier arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used. This led to a vulnerability on Packagist.or...

composer 参数注入漏洞

composer is a software application . It provides a declaration to manage and install dependencies for PHP projects. composer suffers from a parameter injection vulnerability that stems from a lack of input validation. An attacker can execute commands via VcsDriver::getFileContent...

PT-2022-2529 · Composer +6 · Composer +6

Name of the Vulnerable Software and Affected Versions: Composer affected versions not specified Description: The issue is related to the VcsDriver::getFileContent method in Composer, a dependency manager for PHP. If a user can control the $file or $identifier argument, it may lead to a code...

FreeBSD : Composer -- Command injection vulnerability (24a9bd2b-bb43-11ec-af81-0897988a1c07)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 24a9bd2b-bb43-11ec-af81-0897988a1c07 advisory. - Composer is a dependency manager for the PHP programming language. Integrators using Composer code to...

Composer -- Command injection vulnerability

Composer developers reports: The Composer method VcsDriver::getFileContent with user-controlled $file or $identifier arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Java Deserialization (CVE-2020-4521)

Summary IBM Maximo Asset Management is vulnerable to Java Deserialization. Vulnerability Details CVEID:CVE-2020-4521 DESCRIPTION: IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in Java. By sendin...

Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius

Impact There is a possibility to upload an SVG file containing XSS code in the admin panel. In order to perform an XSS attack, the file itself has to be opened in a new card or loaded outside of the IMG tag. The problem applies both to the files opened on the admin panel and shop pages. Patches T...

CVE-2020-27958

The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted input in a job template...

CVE-2020-27958

The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted input in a job template...

CVE-2020-27958

The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted input in a job template...

CVE-2020-27958

The CVE affects the Open OnDemand Open OnDemand Job Composer app used by Ohio Supercomputer Center, specifically versions before 1.7.19 (and 1.8.x before 1.8.18). The reported issue is that remote authenticated users can supply crafted input through a job template, potentially impacting how jobs ...

Package Dependencies Detected

Programming languages are often used along with package management tools designed to help developers manages the code dependencies when building their web applications for example : Composer for PHP, NPM for NodeJS, PIP for Python.... These tools usually work by requesting public code repositorie...

Vendor Stream Wrapper - Moderately critical - Unsupported - SA-CONTRIB-2022-019

This module provides a stream wrapper for files located in the vendor directory. Even when the vendor directory is moved outside the webroot, it allows providing publically accessible URLs to these files. The module exposes all files that are in the vendor directory, without a site owner's...

Design/Logic Flaw

Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...

CVE-2022-21642

CVE-2022-21642 affects Discourse (open source community platform). In affected versions, when composing a message from a topic, the composer’s user suggestions reveal whisper participants, constituting information disclosure. The issue has been fixed in stable version 2.7.13 and in beta version 2...

PT-2022-14998 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.7.13 Discourse versions prior to 2.8.0.beta11 Description: Discourse is an open source platform for community discussion. In affected versions, when composing a message from a topic, the composer user suggestions...

osbuild-composer bug fix and enhancement update

OSBuild-Composer provides an image-building service based on OSBuild. Bug fixes and Enhancements: OSBuild Composer can now work with multiple subscriptions and custom CA certificates. This is useful, for instance, when the host system is subscribed to multiple repositories managed by Satellite...

osbuild-composer bug fix and enhancement update

An update is available for osbuild, osbuild-composer. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OSBuild-Composer provides an image-building service based o...