5038 matches found
CVE-2023-45847 Playbook Plugin Crash via Run Checklist
Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin...
CVE-2023-45847
Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin...
Mattermost Security Vulnerabilities
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from an inability to check whether a user is a guest when updating a private Playbook run, which can be exploited by an attacker to update a...
PT-2023-31401 · Unknown · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows a guest user to update tasks of a private playbook run if they know the run ID, due to a lack of proper user checks. Recommendations: At the moment, there is no...
PT-2023-8221 · Unknown · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to the fixed version Description: The issue is related to a lack of validation for relative paths in the /plugins/playbooks/api/v0/telemetry/run/ endpoint, allowing an attacker to use a path traversal payload to poin...
CVE-2023-45316: Cross-Site Request Forgery (CSRF)
Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/ as a telemetry run ID, allowing an attacker to use a path traversal payload that points to a different endpoint leading to a CSRF attack...
CVE-2023-49874: Improper Access Control
Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID...
Improper Link Resolution Before File Access (Leaky Vessels)
Overview Affected versions of this package are vulnerable to Improper Link Resolution Before File Access Leaky Vessels allowing arbitrary file deletion on the host system. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for th...
CVE-2023-40238
A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address duri...
[SECURITY] Fedora 39 Update: motif-2.3.4-30.fc39
This is the Motif 2.3.4 run-time environment. It includes the Motif shared libraries, needed to run applications which are dynamically linked against Motif and the Motif Window Manager mwm...
Fedora: Security Advisory for motif (FEDORA-2023-ba2e60e743)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 37 Update: motif-2.3.4-30.fc37
This is the Motif 2.3.4 run-time environment. It includes the Motif shared libraries, needed to run applications which are dynamically linked against Motif and the Motif Window Manager mwm...
postgresql: Extension scripts replace objects not belonging to the extension.
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the objec...
CVE-2023-49314
Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack...
Vulnerability of the proxy_run_coroutine() function (proto_proxy.c) of the memcached data caching software, which allows a hacker to cause a service failure
The vulnerability of the proxyruncoroutine function protoproxy.c in the memcached data caching software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to cause service failures through a specially crafted HTTP request...
Sandwich attack on buy()
Lines of code Vulnerability details Impact Function Market:buy does not check or take in a minimum buy amount. This makes users' funds vulnerable to sandwich attacks. buy will increase shareDataid.tokenCount, and thus change the exchange rate of share price. price, fee =...
Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Nov 2023)
This host is missing a critical security update according to Microsoft Office Click-to-Run update November 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
DepositPool is susceptible to the inflation attack
Lines of code Vulnerability details Summary The DepositPool contract is susceptible to the Inflation Attack, in which the first depositor can be front-runned by an attacker to steal their deposit. Impact The DepositPool pool contract acts mainly as a vault: accounts deposit LST assets and get bac...
