GHSA-7M27-7GHC-44W9 Next.js Allows a Denial of Service (DoS) with Server Actions

Impact A Denial of Service DoS attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low...

CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

CVE-2024-56332 Next.js Vulnerable to Denial of Service (DoS) with Server Actions

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service DoS attack that allows attackers to construct requests that leaves requests to Server Actions hanging...

Next.js 安全漏洞

Next.js is a React framework open-sourced by Vercel. Next.js suffers from a security vulnerability that stems from vulnerability to a denial of service DoS attack, where an attacker can construct a request to operate on the server to be in a hung state until the hosting provider cancels the...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation where an attacker can copy the session cookie before a user logs out. Note: This is only exploitable if the attacker manages to capture the session cookie before the log out process. Workaround Self-hosting users are...

CVE-2024-56358 Cross-site Scripting vulnerability through svg attachment previews in grist-core

grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are...

CVE-2024-51479 Authorization bypass in Next.js

Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For...

CVE-2024-51479

Next.js CVE-2024-51479: A pathname-based authorization check in middleware can bypass access control for root-level pages (e.g., /foo) while not affecting deeper paths (e.g., /foo/bar). Patch available in Next.js 14.2.15 and later; if hosted on Vercel, mitigation is automatic. IBM-related notices...

Next.js authorization bypass vulnerability

Impact If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed. Patches This issue was patched in Next.js 14.2.15 and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatical...

Malicious code in 000webhost-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 725d2bf04ddf915f303fabf69710fc72dda0ebbd3d770b0d799f7cba032c98eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

D-Tale allows Remote Code Execution through the Custom Filter Input

Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enablecustomfilters flag. You can fi...

Cross-site Scripting (XSS)

Overview dtale is a Web Client for Visualizing Pandas Objects Affected versions of this package are vulnerable to Cross-site Scripting XSS through the update-settings endpoint, allowing an attacker to use enablecustomfilters to specify custom filters will be used for exploitation of this...

GHSA-832W-FHMW-W4F4 D-Tale allows Remote Code Execution through the Custom Filter Input

Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enablecustomfilters flag. You can fi...

CVE-2024-55890

D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability...

CVE-2024-54320

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in icdsoft ICDSoft Reseller Store icdsoft-reseller-store allows Reflected XSS.This issue affects ICDSoft Reseller Store: from n/a through = 2.4.5...

JetBrains YouTrack Denial of Service Vulnerability

JetBrains YouTrack is a project management tool developed by JetBrains that supports cloud hosting and local deployment. A denial of service vulnerability exists in JetBrains YouTrack, which can be exploited by an attacker to execute a regular expression resulting in a denial of service...

JetBrains YouTrack Path Traversal Vulnerability

JetBrains YouTrack is a project management tool, developed by JetBrains, supporting cloud hosting and local deployment, providing task management, team collaboration, time tracking and other features for software development, human resources and other scenarios. JetBrains YouTrack suffers from a...

CVE-2024-54136 Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to...

JetBrains YouTrack Improper Access Control Vulnerability

JetBrains YouTrack is a project management tool developed by JetBrains that supports cloud hosting and local deployment. JetBrains YouTrack suffers from an improper access control vulnerability that stems from allowing project names to be listed without authentication during application import. A...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a project management tool developed by JetBrains that supports cloud hosting and local deployment. A denial of service vulnerability exists in JetBrains YouTrack, which can be exploited by an attacker to execute a regular expression resulting in a denial of service...