9434 matches found
CVE-2022-24794
Express OpenID Connect (express-openid-connect) CVE-2022-24794 describes an Open Redirect vulnerability when requiresAuth is applied on a catch-all route. Affected versions are prior to 2.7.2. The issue arises because the original URL reported by the Express framework is not properly sanitized, a...
CVE-2022-24794 Open Redirect in express-openid-connect
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...
URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect
Impact Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under example.com are protected with the requiresAuth middleware, a visit to...
GHSA-7P99-3798-F85C URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect
Impact Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under example.com are protected with the requiresAuth middleware, a visit to...
Exploit for Code Injection in Oracle Fusion_Middleware
CVE-2022-22965 - vulnerable app and PoC ------------------------...
Oracle Fusion Middleware Unspecified Vulnerability
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectors...
openstack-neutron: Routes middleware memory leak for nonexistent controllers
A resource-allocation flaw was found in openstack-neutron. An authenticated attacker could make API requests involving nonexistent controllers causing the API worker to consume increasing amounts of memory. This flaw could be exploited to force API performance degradation or denial of service...
RHEL 8 : Red Hat OpenStack Platform 16.2 (openstack-neutron) (RHSA-2022:0996)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0996 advisory. OpenStack Networking neutron is a virtual network service for OpenStack. Just as OpenStack Compute nova provides an API to dynamically request and...
openstack-neutron: Routes middleware memory leak for nonexistent controllers
A resource-allocation flaw was found in openstack-neutron. An authenticated attacker could make API requests involving nonexistent controllers causing the API worker to consume increasing amounts of memory. This flaw could be exploited to force API performance degradation or denial of service...
Pro-Ukraine ‘Protestware’ Pushes Antiwar Ads, Geo-Targeted Malware
Researchers are tracking a number of open-source "protestware" projects on GitHub that have recently altered their code to display "Stand with Ukraine" messages for users, or basic facts about the carnage in Ukraine. The group also is tracking several code packages that were recently modified to...
GHSA-H3Q4-VMW4-CPR5 Path Traversal in Gitea
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...
The vulnerability of the Oracle Access Manager component of the Oracle Fusion Middleware software allows a perpetrator to execute arbitrary code.
The vulnerability of the Oracle Access Manager component of the Oracle Fusion Middleware software is related to errors in processing http requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Path Traversal in Gitea
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...
Gitea Directory Traversal Vulnerability
Gitea is an open source community-driven clone of Gogs, a popular Git self-hosted service. A directory traversal vulnerability exists on Gitea that can be exploited by an attacker to allow the avatar middleware in Gitea to allow directory traversal via a crafted URL...
CVE-2021-29134
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...
CVE-2021-29134
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...
Directory traversal
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...
CVE-2021-29134
The CVE-2021-29134 entry relates to Gitea prior to v1.13.6, where the avatar middleware is susceptible to Directory Traversal via a crafted URL. Affected component: avatar middleware in Gitea; root cause: improper handling of path components enables traversal to arbitrary files. Impact: potential...
