CVE-2024-27631

Detalles de la vulnerabilidad CVE-2024-27631 Resumen En Savane v3.12 y versiones anteriores, la falta de protección CSRF en las funciones administrativas puede permitir la escalada de privilegios y/o la toma de control de cuentas. En particular, el endpoint /siteadmin/usergroup.php incluye la...

CVE-2024-29399

CVE-2024-29399 Detalles de la Vulnerabilidad Resumen En Savane v3.13 y anteriores, la falta de validación en los archivos subidos puede permitir una escalada de privilegios. Los servidores web configurados según las instrucciones de instalación son vulnerables a Cross‑Site Scripting XSS. En...

CVE-2024-27630

Detalles de la Vulnerabilidad CVE-2024–27630 Resumen En Savane v3.12 y anteriores, la falta de validación del parámetro fileid al eliminar un archivo de /bugs/index.php conduce a una vulnerabilidad de Referencia Directa a Objetos Insegura IDOR que puede hacer que un administrador autenticado de u...

CVE-2024-27632

Detalles de la Vulnerabilidad CVE-2024-27632 Resumen En Savane v3.12 y anteriores, la marca de tiempo Unix se utiliza como semilla en el Generador de Números Pseudoaleatorios PRNG empleado para generar tokens de protección contra Falsificación de Solicitudes entre Sitios CSRF formid. Como...

CVE-2026-56355

GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...

EUVD-2026-38135

GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...

CVE-2026-56355

GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...

CVE-2026-56355

GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization...

CVE-2026-56355

CVE-2026-56355 affects GNU Savannah Administration Savane up to version 3.17. The connected documents describe an authorization issue caused by using untrusted data in the authorization path. No explicit exploit vectors, impact details, or remediation/fixes are provided in the documents. Technica...

EUVD-2024-24826

Malicious code in bioql PyPI...

EUVD-2024-24824

Malicious code in bioql PyPI...

CVE-2024-29399

An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component...

CVE-2024-27630

Insecure Direct Object Reference IDOR in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackersdatadeletefile function...

CVE-2024-27632

An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the formid in the formheader function...

CVE-2024-27631

Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php...

CVE-2024-29399

An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component...

CVE-2024-29399

An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component...

CVE-2024-29399

An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component...

PT-2024-22879 · Gnu · Gnu Savane

Name of the Vulnerable Software and Affected Versions: GNU Savane versions 3.13 and earlier Description: An issue allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the "upload.php" component. Recommendations: For GNU Savane versions 3.13 and earlier,...

GNU Savane 安全漏洞

GNU Savane is a collaborative software development management system for the US GNU community. A security vulnerability exists in GNU Savane v.3.13 and earlier versions, which stems from a vulnerability that could allow a remote attacker to execute arbitrary code and escalate privileges via a...