Lucene search
+L

766775 matches found

Github Security Blog
Github Security Blog
added 2026/08/20 6:43 p.m.8 views

netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

Summary io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can us...

5.9AI score
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/08/20 6:43 p.m.7 views

GHSA-PGRF-4654-3GQ8 netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...

5.3CVSS6AI score
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/08/20 6:43 p.m.7 views

netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...

5.9AI score
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/08/20 6:43 p.m.7 views

netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...

5.6AI score
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/08/20 6:43 p.m.7 views

GHSA-2MC4-J865-9Q4R netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...

8.1CVSS5.6AI score
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/08/20 6:42 p.m.9 views

django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

4.4CVSS5.4AI score0.00165EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/08/20 6:42 p.m.7 views

GHSA-HVQ6-2R72-P2X7 django CMS: Stored XSS in edit-mode plugin exception rendering

Summary When plugin rendering fails in edit mode, django CMS renders a cms-rendering-exception block so editors can see that a placeholder could not be rendered. Older code built that block's heading by interpolating the exception message, placeholder/source strings, and the failing plugin's shor...

4.4CVSS5.5AI score0.00165EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/08/20 6:42 p.m.7 views

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...

6.2AI score
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/08/20 6:42 p.m.6 views

GHSA-GHVF-QF6H-G8X5 NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...

6.2AI score
SaveExploits0References6
OSV
OSV
added 2026/08/20 6:38 p.m.7 views

GHSA-MMG4-322V-6JVC Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Summary The Blade template for the color column type src/resources/views/crud/columns/color.blade.php has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column'escaped' defaults to true, values stored in color columns are rendere...

5.4CVSS5.6AI score
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/20 6:38 p.m.9 views

Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

Summary The Blade template for the color column type src/resources/views/crud/columns/color.blade.php has its escaped/unescaped rendering branches inverted relative to every other column template in the library. Because $column'escaped' defaults to true, values stored in color columns are rendere...

5.6AI score
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/08/20 6:38 p.m.6 views

GHSA-8HW4-7QJR-3WXG Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...

4.4CVSS5.5AI score
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/20 6:38 p.m.9 views

Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...

5.5AI score
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/08/20 6:35 p.m.6 views

node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

5.6AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/08/20 6:35 p.m.5 views

GHSA-MQ36-523M-X7VV node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

7.7CVSS5.6AI score
SaveExploits0References2
OSV
OSV
added 2026/08/20 6:35 p.m.7 views

GHSA-2P39-2JF3-FV2Q next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...

6.9CVSS5.7AI score
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/20 6:35 p.m.9 views

next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...

5.6AI score
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/08/20 6:34 p.m.4 views

GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

3.7CVSS5.6AI score
SaveExploits0References8
Github Security Blog
Github Security Blog
added 2026/08/20 6:34 p.m.5 views

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

5.5AI score
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
added 2026/08/20 6:30 p.m.7 views

stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...

5.7AI score
SaveExploits0References6Affected Software1
Rows per page
Query Builder