145488 matches found
GHSA-VGXM-H9GX-H9W7 django CMS: Structure endpoint bypasses page-view permission
Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...
GHSA-4XFR-4P46-GC6P django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...
node-opcua missing nonce verification in UserNameIdentityToken authentication
Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...
GHSA-MQ36-523M-X7VV node-opcua missing nonce verification in UserNameIdentityToken authentication
Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...
GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...
GHSA-5P3M-VHH6-9236 stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty
Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-15057 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3...
Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty
Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-15057 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is...
K000162855: Intel SMM vulnerability CVE-2025-20028
Security Advisory Description Time-of-check time-of-use race condition in the WheaERST SMM module for some IntelR reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege...
GHSA-533J-2V4Q-MW5H LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...
GHSA-89V8-RHWQ-HF77 asteval has a Sandbox Escape via BaseException Subclasses
Summary An attacker who can supply expressions to asteval.Interpreter.eval can raise SystemExit, KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. These exceptions are subclasses of BaseException but not Exception, so they bypass the except Exception: safety net in both...
asteval has a Sandbox Escape via BaseException Subclasses
Summary An attacker who can supply expressions to asteval.Interpreter.eval can raise SystemExit, KeyboardInterrupt, GeneratorExit, or BaseException from inside the sandbox. These exceptions are subclasses of BaseException but not Exception, so they bypass the except Exception: safety net in both...
GHSA-9W56-46F6-3QHX asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
Summary With its default configuration numpy enabled, import disabled, asteval's Interpreter lets an attacker-controlled expression obtain a raw arbitrary process-memory read and write primitive, without using import, any dunder attribute, or eval/exec/getattr. Arbitrary in-process read/write is...
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
Summary With its default configuration numpy enabled, import disabled, asteval's Interpreter lets an attacker-controlled expression obtain a raw arbitrary process-memory read and write primitive, without using import, any dunder attribute, or eval/exec/getattr. Arbitrary in-process read/write is...
GHSA-QQFF-5854-PX68 vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie...
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS
Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie...