8220 matches found
GHSA-9P43-HJ5J-96H5 esphome vulnerable to stored Cross-site Scripting in edit configuration file API
Summary Edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation and Home Assistant add-on serves unsanitized data with “Content-Type: text/html; charset=UTF-8”, allowing remote authenticated user to inject arbitrary web script and exfiltrate sessi...
esphome vulnerable to stored Cross-site Scripting in edit configuration file API
Summary Edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation and Home Assistant add-on serves unsanitized data with “Content-Type: text/html; charset=UTF-8”, allowing remote authenticated user to inject arbitrary web script and exfiltrate sessi...
BIT-GITLAB-2020-13267
A Stored Cross-Site Scripting vulnerability allowed the execution on Javascript payloads on the Metrics Dashboard in GitLab CE/EE 12.8 and later through 13.0.1...
BIT-GITLAB-2020-13320
An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to view the project security dashboard...
BIT-GITLAB-2022-0390
Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard...
BIT-MEDIAWIKI-2021-42047
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload such as alert via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback...
BIT-GRAFANA-2020-11110
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...
BIT-GRAFANA-2021-27962
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access...
BIT-APISIX_DASHBOARD-2021-33190 Bypass network access control
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...
BIT-APISIX_DASHBOARD-2021-45232 security vulnerability on unauthorized access.
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
PT-2024-22673
Name of the Vulnerable Software and Affected Versions ESPHome versions 2023.12.9 through 2024.2.x ESPHome version 2023.12.9 Description The dashboard component of ESPHome contains API endpoints that are vulnerable to Cross-Site Request Forgery CSRF, allowing remote attackers to carry out attacks...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: aws-load-balancer-controller-fips, kubernetes-event-exporter, amass, kube-oidc-proxy, kube-logging-logging-operator, k3s, rabbitmq-cluster-operator, prometheus-alertmanager-fips, step-ca, node-problem-detector, nri-discovery-kubernetes, cosign-fips,...
CVE-2024-24785 vulnerabilities
Vulnerabilities for packages: k8sgpt-operator, fuse-overlayfs-snapshotter, gops, kubernetes-event-exporter, terraform, gcsfuse, render-template, amass, gosu, yam, mongo-tools, golangci-lint, pulumi-language-java, flux-image-automation-controller, spark-operator, cortex,...
Piwigo < 14.2.0 XSS Vulnerability
Piwigo is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo"; if...
GHSA-8P25-3Q46-8Q2P ESPHome vulnerable to remote code execution via arbitrary file write
Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...
ESPHome vulnerable to remote code execution via arbitrary file write
Summary Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Detail...
CVE-2024-27296 Directus version number disclosure
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known...
CVE-2024-27296
CVE-2024-27296 affects Directus: prior to 10.8.3, the exact Directus version is shipped in compiled JS bundles accessible without authentication, enabling attackers to map to known vulnerabilities in Directus core or dependencies. The issue has been fixed in 10.8.3 and later. Remediation is upgra...
CVE-2024-27295
Directus vulnerability CVE-2024-27295: the password reset flow can be abused due to accent-insensitive and case-insensitive comparisons in MySQL/MariaDB, enabling an attacker to request a reset for a victim’s account by using a near-identical email address (with accented characters). The issue af...