14660 matches found
GHSA-HP2X-6VRM-7J7V Apache Archiva Reflected Cross-site Scripting vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or...
CVE-2024-27140
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended...
CVE-2024-27138
UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue...
PT-2024-2659 · Apache · Apache Archiva
Name of the Vulnerable Software and Affected Versions: Apache Archiva versions 2.0.0 and later Description: The issue is related to an Incorrect Authorization vulnerability in Apache Archiva, allowing an unauthenticated attacker to modify account data, potentially leading to account takeover. Thi...
PT-2024-21671 · Apache · Apache Archiva
Name of the Vulnerable Software and Affected Versions: Apache Archiva versions 2.0.0 and later Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This affects Apache Archiva, a product that is no longer supported b...
PT-2024-21802 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus versions prior to 10.8.3 Description: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are...
PT-2024-20866 · Mjml-App · Mjml-App
Name of the Vulnerable Software and Affected Versions: mjml-app versions 3.0.4 through 3.1.0-beta Description: The issue allows for remote code execution RCE via the href attribute. Recommendations: For versions 3.0.4 and 3.1.0-beta, consider restricting access to the href attribute until a patch...
PT-2024-14625 · Unknown · Mongo-Express
Name of the Vulnerable Software and Affected Versions: mongo-express version 1.0.2 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, as demonstrated by the deletion of a Collection through the /admin endpoint. Recommendations: For mongo-express version 1.0.2, consider...
Google Chrome Security Bypass Vulnerability (CNVD-2024-16936)
Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome that stems from an improper implementation of the Content Security Policy module. An attacker can exploit this vulnerability to bypass security restrictions...
PT-2024-20940 · Public Knowledge · Pkp Ojs
Name of the Vulnerable Software and Affected Versions: Pkp Ojs version 3.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Publicname parameter. Recommendations: For Pkp Ojs version 3.3, consider...
ASB-A-311687929
In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for...
CVE-2024-23488
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled...
CVE-2024-23488 Files of archived channels accessible with the “Allow users to view archived channels” option disabled
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled...
CVE-2024-23488 Files of archived channels accessible with the “Allow users to view archived channels” option disabled
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled...
CVE-2024-23488 Files of archived channels accessible with the “Allow users to view archived channels” option disabled
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled...
CVE-2024-23488
Mattermost CVE-2024-23488 concerns a file-access control bug in archived channels. Connected advisory GO-2024-2595 describes a vulnerability in github.com/mattermost/mattermost/server/v8 prior to v8.1.9 where attachments in posts could be accessed despite channel archives settings. Affected compo...
CVE-2024-25830
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the...
CVE-2023-49931
An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted...