31307 matches found
ActionText ContentAttachment can Contain Unsanitized HTML
Instances of ActionText::Attachable::ContentAttachment included within a richtextarea tag could potentially contain unsanitized HTML. This has been assigned the CVE identifier CVE-2024-32464. Versions Affected: = 7.1.0 Not affected: 7.1.0 Fixed Versions: 7.1.3.4 Impact ------ This could lead to a...
SUSE-SU-2024:1908-1 Security update for ffmpeg
This update for ffmpeg fixes the following issues: - CVE-2023-51794: Fixed a heap buffer overflow in libavfilter. bsc1223437...
PT-2024-26581 · Unknown · Ninja Tables
Name of the Vulnerable Software and Affected Versions: Ninja Tables versions through 5.0.9 Description: A Server-Side Request Forgery SSRF issue has been identified. This allows an attacker to trick the server into making unintended requests, potentially leading to unauthorized access to sensitiv...
PT-2024-4423
Name of the Vulnerable Software and Affected Versions cri-o versions prior to 1.30.1 cri-o versions prior to 1.29.5 cri-o versions prior to 1.28.7 Description A flaw was found in cri-o, allowing a malicious container to create a symbolic link to arbitrary files on the host via directory traversal...
Android Security Bulletin—June 2024Stay organized with collectionsSave and categorize content based on your preferences.
The Wear OS Security Bulletin contains details of security vulnerabilities affecting the Wear OS platform. The full Wear OS update comprises the security patch level of 2024-06-05 or later from the June 2024 Android Security Bulletin in addition to all issues in this bulletin. We encourage all...
SQL Injection in Harbor scan log API
Impact A user with an administrator, projectadmin, or projectmaintainer role could utilize and exploit SQL Injection to allow the execution of any Postgres function or the extraction of sensitive information from the database through this API: GET...
Open Redirect URL in Harbor
Description Under OIDC authentication mode, there is a redirecturl parameter exposed in the URL which is used to redirect the current user to the defined location after the successful OIDC login, This redirecturl can be an ambiguous URL and can be used to embed a phishing URL. For example: if a...
GHSA-CJCC-P67M-7QXM Unsafe Reflection in base Component class in yiisoft/yii2
Yii2 supports attaching Behaviors to Components by setting properties having the format 'as '. Internally this is done using the set magic method. If the value passed to this method is not an instance of the Behavior class, a new object is instantiated using Yii::createObject$value. However, ther...
CVE-2024-32487 affecting package less for versions less than 643-2
CVE-2024-32487 affecting package less for versions less than 643-2. A patched version of the package is available...
CVE-2024-24788 affecting package golang for versions less than 1.22.3-1
CVE-2024-24788 affecting package golang for versions less than 1.22.3-1. A patched version of the package is available...
PT-2024-15201 · WordPress · Auto Featured Image
Name of the Vulnerable Software and Affected Versions: Auto Featured Image Auto Post Thumbnail plugin for WordPress versions up to, and including, 4.0.0 Description: The issue allows authenticated attackers with author-level access and above to make web requests to arbitrary locations originating...
CVE-2024-35221 Denial of service when publishing a package on rubygems.org
Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.fromyaml. fromyaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-bas...
CVE-2023-52881 tcp: do not accept ACK of bytes we never sent
In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 guidelines: The ACK value is considered...
BIT-ARGO-CD-2024-31989 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS...
ansibleguy-webui Cross-site Scripting vulnerability
Impact Multiple forms in version = 0.0.21 References Report GitHub Issue 44...
GHSA-RPJ9-XJWM-WR6W Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality
Impact Stored Cross-site scripting XSS enable attackers to inject malicious code into Print Functionality Patches 12.1.4, 10.0.5 References https://docs.umbraco.com/umbraco-commerce/release-notesid-13.0.0-december-13th-2023...
Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality
Impact Stored Cross-site scripting XSS enable attackers to inject malicious code into Print Functionality Patches 12.1.4, 10.0.5 References https://docs.umbraco.com/umbraco-commerce/release-notesid-13.0.0-december-13th-2023...
CVE-2024-32004 affecting package git for versions less than 2.39.4-1
CVE-2024-32004 affecting package git for versions less than 2.39.4-1. An upgraded version of the package is available that resolves this issue...
PT-2024-26233 · F Logic · F-Logic Datacube3
Name of the Vulnerable Software and Affected Versions: F-logic DataCube3 version 1.0 Description: The issue is related to command injection due to improper string filtering at the command execution point in the ./admin/transceiver schedule.php file. An unauthenticated remote attacker can exploit...