389 matches found
RUSTSEC-2022-0088 `tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope
It is possible for readDir to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in this issue. This is corrected in this PR by checking if a directory is a symlink before reading from it...
`tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope
It is possible for readDir to incorrectly enumerate files from a symlinked directory if called recursively when specifying an empty string for the dir parameter as outlined in this issue. This is corrected in this PR by checking if a directory is a symlink before reading from it...
CVE-2021-32771 Buffer overflow in contiki-ng
Contiki-NG is an open-source, cross-platform operating system for IoT devices. In affected versions it is possible to cause a buffer overflow when copying an IPv6 address prefix in the RPL-Classic implementation in Contiki-NG. In order to trigger the vulnerability, the Contiki-NG system must have...
curitiba.pr.gov.br Cross Site Scripting vulnerability OBB-2749434
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Malicious code in check-pr-files (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0961e1ec14afe7f9d5370e706429bdc66c4b03ca6d4cc94b81c4a5c7deaaa031 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5335 Malicious code in ping-on-pr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3207a9a6ac9717095c2d6763f67b2f2c915a109c1c32ebb48e28a68753aa11d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ping-on-pr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3207a9a6ac9717095c2d6763f67b2f2c915a109c1c32ebb48e28a68753aa11d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6229 Malicious code in spark-pr-board (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120c6f6b14abe7ae9c2ac0f2e14844f9f2cd26b7cf7b33a677e013d0f6db4891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in spark-pr-board (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120c6f6b14abe7ae9c2ac0f2e14844f9f2cd26b7cf7b33a677e013d0f6db4891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-831 Malicious code in action-create-release-pr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1f9c096fa3bf9d38477488398a8d49d517f96c85896b4312ef8e8771336c43a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in assign-pr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62e185441fd99093a564a1a297859285aaf49df491f7beb894114173c842fd0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1144 Malicious code in assign-pr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62e185441fd99093a564a1a297859285aaf49df491f7beb894114173c842fd0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Design/Logic Flaw
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...
CVE-2022-29220 No verification of commits origin in github-action-merge-dependabot
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...
CVE-2022-29220
CVE-2022-29220 concerns the github-action-merge-dependabot GitHub Action. Prior to version 3.2.0, it does not verify that commits created by dependabot are signed with the correct GPG key; it only checks that the PR actor is dependabot[bot]. This enables a threat actor with access to the pipeline...
CVE-2022-29220 No verification of commits origin in github-action-merge-dependabot
github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, github-action-merge-dependabot does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set t...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...
pr-rp.hc-sc.gc.ca Cross Site Scripting vulnerability OBB-2558327
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Manipulated inline images can cause Infinite Loop in PyPDF2
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code: python from PyPDF2 import PdfFileReader, PdfFileWriter from PyPDF2.pdf import ContentStream reader = PdfFileReader"malicious.pdf", strict=False for page in...
