Server side request forgery (ssrf)

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery SSRF vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote...

Design/Logic Flaw

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their...

CVE-2023-46237 FOG path traversal via unauthenticated endpoint

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their...

CVE-2023-46236 FOG SSRF via unauthenticated endpoint(s)

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery SSRF vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote...

CVE-2023-46235

CVE-2023-46235 affects the FOG project prior to version 1.5.10.15, where a lack of request sanitization in log handling allows a malicious request containing XSS to be stored in a log file. When an administrator views the logs in the dashboard, the content is parsed as HTML, enabling XSS exposure...

CVE-2023-46235 FOG stored XSS on log screen via unsanitized request logging

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the log...

[SECURITY] Fedora 37 Update: slurm-22.05.10-1.fc37

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...

Cody, security breach.

Cody is a free open source AI coding assistant open sourced by Sourcegraph. It can write and fix code, provide AI-generated auto-completion, and answer coding questions. A security vulnerability exists in Cody versions 0.10.0 through 0.14.0 that stems from vulnerability to remote code execution...

Google Android Code Execution Vulnerability (CNVD-2024-05391)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code execution vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

Google Android Information Disclosure Vulnerability (CNVD-2024-05389)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android Information Disclosure Vulnerability (CNVD-2024-05387)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android Information Disclosure Vulnerability (CNVD-2024-05392)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android Information Disclosure Vulnerability (CNVD-2024-05384)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Apache Airflow Log Information Disclosure Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow has a log information leakage vulnerability , the vulnerability stem...

Exim Security Vulnerabilities

Exim is an open source messaging agent MTA running on Unix systems that routes, forwards, and delivers mail. A security vulnerability exists in Exim that stems from Exim incorrectly processing user-supplied authentication data, resulting in memory corruption...

Google Android Information Disclosure Vulnerability (CNVD-2024-05390)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

Google Android elevation of privilege vulnerability (CNVD-2024-05388)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability, which is caused by a privilege bypass in onCreate of ApnEditor.java. An attacker can exploit this vulnerability to gain elevated privileges...

Google Android elevation of privilege vulnerability (CNVD-2024-05386)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by attackers to gain elevated privileges...

Huawei EulerOS: Security Advisory for file (EulerOS-SA-2023-3027)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-45672

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at /confi...