Design/Logic Flaw

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious...

Able to mint any amount of PT

Lines of code Lender.solL192-L235 Lender.solL486-L534 Lender.solL545-L589 Vulnerability details Impact Some of the lend functions do not validate addresses sent as input which could lead to a malicous user being able to mint more PT tokens than they should. Functions affect: Illuminate and Yield...

Illuminate PT redeeming allows for burning from other accounts

Lines of code Vulnerability details Illuminate PT burns shares from a user supplied address account instead of user's account. With such a discrepancy a malicious user can burn all other's user shares by having the necessary shares on her balance, while burning them from everyone else. Setting th...

Sense AMM address can be manipulated, allowing unlimited mint of principal tokens

Lines of code Vulnerability details Lender's lend for Sense uses ISensex.swapUnderlyingForPTs output to determine the Illuminate PT amount to be minted for the user. x is a user supplied and not verified address, which can be precooked by a malicious user to return any inflated amount, that will ...

Design/Logic Flaw

A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access...

CVE-2021-30651

A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that they might not otherwise be authorized to access...

Cross-site Scripting (XSS)

brotkrueml/schema is vulnerable to cross site scripting. The vulnerability exists in the render function in Renderer.php due to a lack of sanitization in user input which allows a malicious backend user to inject and execute arbitrary javascript...

Remote code execution

flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code...

CVE-2022-29241 Known or guessable hidden files may be accessed in Jupyter Server

Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of rootdir that contains the starting user's home directory, then the underlying REST API ca...

CVE-2022-29241

CVE-2022-29241 affects Jupyter Server (backend for Jupyter web apps) prior to 1.17.1. If notebook_server is started with root_dir containing the starting user’s home directory, an authenticated user can leak the start-time access token via the REST API by guessing/brute-forcing the server PID. Th...

Cross site scripting

Dell SupportAssist Client Consumer versions 3.10.4 and prior and Dell SupportAssist Client Commercial versions 3.1.1 and prior contain a cross-site scripting vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability under specific conditions leading to...

OS Command Injection in file editor in Gogs

Impact The malicious user is able to update a crafted config file into repository's .git directory in combination with crafted file deletion to gain SSH access to the server. All installations with repository upload enabled default are affected. Patches File deletions are prohibited to repository...

GHSA-67MX-JC2F-JGJM OS Command Injection in file editor in Gogs

Impact The malicious user is able to update a crafted config file into repository's .git directory in combination with crafted file deletion to gain SSH access to the server. All installations with repository upload enabled default are affected. Patches File deletions are prohibited to repository...

Server-Side Request Forgery in gogs webhook

Impact The malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected. Patches Webhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network...

Malicious user can populate rewards array with tokens of their interest reaching limits of MAX_REWARD_TOKENS

Lines of code Vulnerability details Impact Malicious user can populate rewards array with different tokens early reaching limit of MAXREWARDTOKENS sending very small amount of different tokens. It will restrict any other tokens to be used as rewards in Bribe.solnotifyRewardAmount Proof of Concept...

Authorization

The REST API in Archer Platform 6.x before 6.11 6.11.0.0 contains an Authorization Bypass Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to view sensitive information. 6.10 P3 6.10.0.3 and 6.9 SP3 P4 6.9.3.4 are also fixed releases...

Session Fixation

filegator/filegator is vulnerable to session fixation. The vulnerability exists in the authenticate function in JsonFile.php due to invalid session generation on user update which allows a malicious user to hijack the session...

Kibana Sensitive Data Disclosure

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connecto...

GHSA-HP5F-QQRW-C8GJ Kibana Sensitive Data Disclosure

It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be intentionally hidden from public view. Using this vulnerability, a malicious user with the ability to create connectors, could utilize these connecto...

GHSA-FGJ8-93XX-F6G6 phpMyAdmin SQL injection in user accounts page

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server...