954 matches found
CVE-2021-40812
The GD Graphics Library aka LibGD through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks...
Bypass of Two Factor Authentication
None...
Exceptions may have logged Encryption-at-Rest key content
None...
Lack of ratelimit on Richdocuments OCS endpoint
None...
Unlimited transforms allowed for signed nodes
Impact A malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. Patches This has been resolved in version 3.1.0. The resolution is to...
Untrusted Search Path in Nextcloud Desktop Client
None...
XSS in Nextcloud Text application
None...
Lack of ratelimit on public DAV endpoint
None...
Filenames not escaped by default in controllers using DownloadResponse
None...
GHSA-PHJ8-4CQ3-794G Unencrypted storage of client side sessions
Impact The default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies. Note: the documentation does point this out and...
Malicious Android application can crash the Nextcloud Android Client
None...
metasploit-framework
This repository is an offensive tool for Metasploit Framework. The Metasploit Framework is a powerful tool for penetration testing and vulnerability assessment. It provides a comprehensive platform for identifying and exploiting vulnerabilities in various systems and applications. The framework...
monkey
This is a Python script repository for a tool called "Infection Monkey". The tool is designed to simulate a cyber attack on a network by injecting malware into the network and observing the behavior of the malware as it spreads. The script is written in Python and uses the "monkey" framework to...
GHSA-HF44-3MX6-VHHW Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.
Impact The regex injection that may lead to Denial of Service. Patches Will be patched in 2.4 and 3.0 Workarounds Versions lower than 2.x are only affected if the navigation module is added References See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304 If you...
Code injection
GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix:...
CVE-2021-29506 Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.
GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix:...
CVE-2021-31903
In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS...
CVE-2021-31903
In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS...
