CVE-2023-25810

CVE-2023-25810 affects Uptime Kuma (self-hosted monitoring tool). The vulnerability is a persistent XSS on the status page in versions prior to 1.20.0. Upgrade to version 1.20.0 or later to fix; there are no documented workarounds. The available sources confirm the issue and the recommended remed...

Uptime Kuma 跨站脚本漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from the individual developer Louis Lam. A security vulnerability exists in Uptime Kuma versions prior to 1.20.0, which stems from the Uptime Kuma name parameter allowing persistent XSS attacks...

PT-2023-20320 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.20.0 Description: Uptime Kuma is a self-hosted monitoring tool. The Uptime Kuma status page allows a persistent XSS attack. Users are advised to upgrade. There are no known workarounds for this vulnerability...

ConnectWise Control 注入漏洞

ConnectWise Control is a self-hosted remote desktop software application from ConnectWise USA. An injection vulnerability exists in ConnectWise Control versions prior to 22.9.10032 that stems from an inability to validate user-supplied parameters...

Nextcloud 安全漏洞

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server that stems from the ability to preview without a watermark...

ConnectWise Control 安全漏洞

ConnectWise Control is a self-hosted remote desktop software application from ConnectWise USA. A security vulnerability exists in ConnectWise Control version 22.8.10013.8329, which stems from vulnerability to cross-origin resource sharing CORS attacks...

github haven 代码问题漏洞

github haven is a software application. self-hostable private blog. A security vulnerability exists in Haven version 5d15944, which can be exploited by an attacker to create new RSS feeds...

CVE-2023-23607 Unrestricted file upload leads to Remote Code Execution in erohtar/Dasherr

erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they ca...

Dasherr 代码问题漏洞

Dasherr is a dashboard for self-hosted services by erohtar individual developers. Dasherr has a code issue vulnerability that stems from not limiting the number of file uploads. An attacker exploiting this vulnerability could execute arbitrary code on the server...

CVE-2022-3573

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...

Input validation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...

UBUNTU-CVE-2022-3573

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...

CVE-2022-3573

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...

GitLab Enterprise Edition和GitLab Community Edition 跨站脚本漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A cross-site scripting vulnerability exists in GitLab CE/EE versions 15.4 through...

CVE-2022-3573

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...

CVE-2022-3573

Removed by vendor...

Nextcloud Talk 访问控制错误漏洞

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. An access control error vulnerability exists in Nextcloud Talk. An attacker could use this vulnerability to access a user's Nextcloud files and view conversations...

GHSA-VWG4-846X-F94V usememos/memos vulnerable to improper authorization

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos versions prior to 0.9.0 are vulnerable to improper authorization, which can allow a user to modify the nickname, username and email of other users without permission...

usememos/memos missing Secure cookie attribute

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking...

GHSA-W57V-6XP4-RM2V usememos/memos vulnerable to account takeover due to improper access control

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request...