20099 matches found
spider-flow code issue vulnerability
spider-flow is a crawler platform open source by sssssssss-team. Spider-flow 0.5.0 previous version of a code problem vulnerability , the vulnerability stems from the component API file src/main/java/org/spiderflow/controller/DataSourceController.java in the DriverManager. There is an unknown...
Fedora: Security Advisory for firefox (FEDORA-2023-c7af372e2e)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PYSEC-2023-176
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...
PYSEC-2023-176
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returni...
CVE-2023-41042
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...
CVE-2023-41043
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...
CVE-2023-38507
Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...
Design/Logic Flaw
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...
Design/Logic Flaw
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...
Design/Logic Flaw
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...
Design/Logic Flaw
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, importing a remote theme loads their assets into memory without enforcing limits for file size or number of files. The issue is patched in...
CVE-2023-41043
Discourse DoS CVE-2023-41043 affects the Discourse platform prior to 3.1.1 (stable) and 3.2.0.beta1 (beta/tests-passed). A malicious admin could generate extremely large icons sprites that are cached per server process, potentially triggering DoS downtime on multisite deployments. The issue is fi...
CVE-2023-41043 Discourse DoS via SvgSprite cache
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious admin could create extremely large icons sprites, which would then be cached in each server process. This may cause server...
CVE-2023-41042
CVE-2023-41042 affects the open‑source forum software Discourse. Prior to Discourse 3.1.1 (stable) and 3.2.0.beta1 (beta/tests-passed), importing a remote theme could load assets into memory without enforcing limits on file size or number of files. This could enable a DoS condition described acro...
CVE-2023-40588 Discourse DoS via 2FA and Security Key Names
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users...
CVE-2023-40588
CVE-2023-40588 affects Discourse (open-source discussion platform). A malicious user could add a 2FA or security key with a crafted name, causing a denial-of-service for other users. Affected versions: prior to 3.1.1 on the stable branch and 3.2.0.beta1 on the beta/tests-passed branches. Mitigati...
CVE-2023-38706
Discourse (open‑source forum software) contains a DoS vulnerability (CVE-2023-38706) where a malicious user can create an unlimited number of drafts with very long draft keys, exhausting server resources. Affected are stable branch < 3.1.1 and beta/tests-passed branches
CVE-2023-38706 Discourse vulnerable to DoS via drafts
Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...
Design/Logic Flaw
Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...
