1240 matches found
CVE-2023-43662
ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...
Authentication flaw
ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...
CVE-2023-43662 Arbitrary file read vulnerability in Shoko Server
ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...
CVE-2023-43662
ShokoServer exposes the /api/Image/WithPath endpoint without authentication in affected versions, passing serverImagePath to System.IO.File.OpenRead without sanitization, enabling arbitrary file reads via a path-traversal/LFI pattern. This can leak sensitive server files, particularly when the Wi...
Design/Logic Flaw
OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. This issue affects every version of OpenComputers with the Internet Card feature enabled; that is, OpenComputers 1.2.0 until 1.8.3 in their most common, default configurations. If the OpenComputers mod is...
chromium -- multiple vulnerabilities
Chrome Releases reports: This update includes 4 security fixes: 1452137 High CVE-2023-3420: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-06-07 1447568 High CVE-2023-3421: Use after free in Media. Reported by Piotr Bania of Cisco Talos on 2023-05-22 1450397 High...
Alert: Million of GitHub Repositories Likely Vulnerable to RepoJacking Attack
Millions of software repositories on GitHub are likely vulnerable to an attack called RepoJacking , a new study has revealed. This includes repositories from organizations such as Google, Lyft, and several others, Massachusetts-based cloud-native security firm Aqua said in a Wednesday report. The...
GitHub Security Lab: [Python] Unsafe Unpacking and TarSlip bug slaying
Vulnerability description not provided...
Thruk Monitoring Web Interface 3.06 - Path Traversal
Exploit Title: Thruk Monitoring Web Interface 3.06 - Path Traversal Date: 08-Jun-2023 Exploit Author: Galoget Latorre @galoget CVE: CVE-2023-34096 Galoget Latorre Vendor Homepage: https://thruk.org/ Software Link: https://github.com/sni/Thruk/archive/refs/tags/v3.06.zip Software Link + Exploit +...
GitHub Security Lab: cpp: if (a+b>c) a=c-b is incorrect if a+b overflows
Vulnerability description not provided...
GitHub Security Lab: JavaScript: Add some new XSS sinks and sources of Next.js (and some extra improvements)
Vulnerability description not provided...
Debian dla-3442 : jupyter-nbconvert - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3442 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3442-1 [email protected] https://www.debian.org/lts/security/...
GitHub Security Lab: [Python] Add Unicode Bypass Validation query tests and help
Vulnerability description not provided...
GitHub Security Lab: [python]: Add some dangerous sinks for paramiko ssh clients
Vulnerability description not provided...
GitHub Security Lab: CPP: Add query for CWE-369: Divide By Zero.
Vulnerability description not provided...
CVE-2023-2104 Improper Access Control in alextselegidis/easyappointments
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0...
Spoofing
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...
GitHub Security Lab: Go : Add more JWT sinks
Vulnerability description not provided...