GHSA-H3QR-39J9-4R5V Data written to GitHub Actions Cache may expose secrets

Impact This vulnerability impacts GitHub workflows using the Gradle Build Action that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets configured for the repository. Secrets configured for GitHub Actions are normally passed to the Gradle Build...

Data written to GitHub Actions Cache may expose secrets

Impact This vulnerability impacts GitHub workflows using the Gradle Build Action that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets configured for the repository. Secrets configured for GitHub Actions are normally passed to the Gradle Build...

CVE-2023-30853 Gradle Build Action data written to GitHub Actions Cache may expose secrets

Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Action prior to version 2.4.2 that have executed the Gradle Build Tool with the configuration cache enabled, potentially exposing secrets...

CVE-2021-44461

Cross-site scripting XSS issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim...

CVE-2021-44461

Cross-site scripting XSS issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim...

CVE-2021-44461: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim...

PT-2023-12546 · Odoo · Odoo Enterprise

Name of the Vulnerable Software and Affected Versions: Odoo Enterprise versions 13.0 through 15.0 Description: The issue is a cross-site scripting XSS problem in the Accounting app, allowing remote attackers who can control the contents of accounting journal entries to inject arbitrary web script...

CVE-2023-1939

No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface...

CVE-2023-1939 No access control for the OTP key on OTP entries

No access control for the OTP key on OTP entries in Devolutions Remote Desktop Manager Windows 2022.3.33.0 and prior versions and Remote Desktop Manager Linux 2022.3.2.0 and prior versions allows non admin users to see OTP keys via the user interface...

CVE-2022-43955

An improper neutralization of input during web page generation CWE-79 in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross si...

Cross site scripting

An improper neutralization of input during web page generation CWE-79 in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross si...

CVE-2022-43955

An improper neutralization of input during web page generation CWE-79 in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross si...

PT-2023-14410

Name of the Vulnerable Software and Affected Versions FortiWeb versions 7.0.0 through 7.0.3 FortiWeb versions 6.3.0 through 6.3.21 FortiWeb versions 6.4 and earlier FortiWeb versions 6.2 and earlier FortiWeb versions 6.1 and earlier FortiWeb versions 6.0 and earlier Description An improper...

CVE-2022-43955: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation CWE-79 in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross si...

Fortinet FortiWeb cross-site scripting vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists in Fortinet...

CVE-2023-20030 Cisco Identity Services Engine XML External Entity Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery SSRF attack through an affected device, or negatively impact the responsiveness of the...

Malicious user can force victims to waste a lot of gas when they redeem their dMute

Lines of code Vulnerability details Proof of Concept When redeeming, the user must iterate through all the elements of userLock to destroy any redeemed locks. foruint256 i = userLocksmsg.sender.length; i 0; i-- UserLockInfo memory lockinfo = userLocksmsg.senderi - 1; // recently redeemed lock,...

CVE-2023-1603

Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights to bypass entry permission via id collision...

Devolutions Remote Desktop Manager security vulnerabilities

Devolutions Remote Desktop Manager is an application from Devolutions Canada. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager version 2023.1.9 and prior versions, which arises from a vulnerability that allows users with...

Devolutions Server security vulnerabilities

Devolutions Server is an application from Devolutions Canada. provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2022.3.13 and prior versions that originates from a privilege bypass when importing or synchronizin...