Reposilite vulnerable to path traversal while serving javadoc expanded files (arbitrary file read) (`GHSL-2024-074`)

Summary Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Details The problem lies in the way how the expanded javadoc files are served. The GET /javadoc/repository//raw/ route uses the path parameter to find the file i...

CVE-2024-45601 Local file Inclusion via static file serving functionality in Mesop

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validatio...

Mesop has a local file Inclusion via static file serving functionality

A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files...

GO-2023-2355 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving

Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving...

CVE-2024-4076

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1...

DEBIAN-CVE-2024-4076

Client queries that trigger serving stale data and that also require lookups in local authoritative zone data may result in an assertion failure. This issue affects BIND 9 versions 9.16.13 through 9.16.50, 9.18.0 through 9.18.27, 9.19.0 through 9.19.24, 9.11.33-S1 through 9.11.37-S1, 9.16.13-S1...

Malicious code in rails_test-serving (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-7008 Malicious code in rails_test-serving (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-36115

CVE-2024-36115 affects Reposilite (v3.5.10 and prior) where artifact content served in the browser can execute JavaScript within the same origin, enabling stored XSS that can access token-secret from localStorage. This can lead to full compromise of the Reposilite instance and, in worst cases, re...

CVE-2024-28103

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3...

CVE-2024-36427

The file-serving function in TARGIT Decision Suite before 24.06.19002 TARGIT Decision Suite 2024 – June allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file...

CVE-2024-36427

The file-serving function in TARGIT Decision Suite before 24.06.19002 TARGIT Decision Suite 2024 – June allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file...

CVE-2024-36427

CVE-2024-36427 affects TARGIT Decision Suite prior to 24.06.19002. The file-serving function allows an authenticated attacker to read or write server files via a crafted file request, with potential code execution through a .xview file. Red Hat and other sources corroborate the same description. ...

CVE-2024-36427

The file-serving function in TARGIT Decision Suite before 24.06.19002 TARGIT Decision Suite 2024 – June allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file...

Jenkins Plugin Report Info 安全漏洞

Jenkins and Jenkins Plugin are both open source products of Jenkins.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application software ... A security...

GHSA-83PV-QR33-2VCF Litestar and Starlite vulnerable to Path Traversal

Summary Local File Inclusion via Path Traversal in LiteStar Static File Serving A Local File Inclusion LFI vulnerability has been discovered in the static file serving component of LiteStar. This vulnerability allows attackers to exploit path traversal flaws, enabling unauthorized access to...

PT-2024-25030

Name of the Vulnerable Software and Affected Versions Litestar versions prior to 2.8.3 Litestar versions prior to 2.7.2 Litestar versions prior to 2.6.4 Description A Local File Inclusion LFI vulnerability has been discovered in the static file serving component of Litestar, allowing attackers to...

CVE-2024-32657 Hydra has persistent XSS vulnerability serving HTML build outputs

Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is...

OESA-2024-1366 rubygem-activestorage security update

Attach cloud and local files in Rails applications. Security Fixes: Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cooki...

BIT-TENSORFLOW-2020-15206 Denial of Service in Tensorflow

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-servin...