Exposure Of Sensitive Information To An Unauthorized Actor

silverstripe/userforms is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. This vulnerability is due to insufficient authorization checks in submission notification emails, potentially enabling an attacker to access sensitive files uploaded through the forms without prope...

BELL-CVE-2023-52881

Bulletin has no description...

BELL-CVE-2024-36015

Bulletin has no description...

Session Fixation

silverstripe/framework is vulnerable to Session Fixation. The vulnerability is due to the failure to invalidate pre-existing cookies when the "remember me" function is disabled, allowing users to remain authenticated even after the function is disabled...

Unrestricted Upload Of File With Dangerous Type

silverstripe/framework is vulnerable for Unrestricted Upload Of File With Dangerous Type. The vulnerability is due to the lack of proper validation and sanitization of uploaded file types, which allows an attacker to upload executable file formats...

Drupal Migrate queue importer module < 2.1.1 - Administrator+ Cross Site Request Forgery (CSRF) vulnerability

Administrator+ Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff in WordPress Module Migrate queue importer versions 2.1.1...

PT-2024-26428 · Yubico · Yubico Security Key Series +3

Name of the Vulnerable Software and Affected Versions: Yubico YubiKey 5 Series versions 5.0.0 through 5.6.x Yubico Security Key Series versions 5.0.0 through 5.6.x Yubico YubiKey Bio Series versions 5.0.0 through 5.6.3 Yubico YubiKey 5 FIPS versions 5.0.0 through 5.7.1 Description: The issue is...

GHSA-RPJ9-XJWM-WR6W Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality

Impact Stored Cross-site scripting XSS enable attackers to inject malicious code into Print Functionality Patches 12.1.4, 10.0.5 References https://docs.umbraco.com/umbraco-commerce/release-notesid-13.0.0-december-13th-2023...

CVE-2024-32004 affecting package git for versions less than 2.39.4-1

CVE-2024-32004 affecting package git for versions less than 2.39.4-1. An upgraded version of the package is available that resolves this issue...

GHSA-XX4R-5265-48J6 silverstripe/framework SQL injection in full text search

When performing a fulltext search in SilverStripe 4.0.0 the 'start' querystring parameter is never escaped safely. This exposes a possible SQL injection vulnerability. The issue exists in 3.5 and 3.6 but is less vulnerable, as SearchForm sanitises these variables prior to passing to mysql...

CVE-2024-35232 github.com/huandu/facebook may expose access_token in error message

github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...

CVE-2021-47543

REJECT This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Pug allows JavaScript code execution if an application accepts untrusted input

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would...

Cross-Site Request Forgery (CSRF)

ezsystems/ezplatform is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the CSRF protection which is not enabled by default., which allows attackers to perform unauthorized actions by exploiting the inactive CSRF token...

BELL-CVE-2024-36011

Bulletin has no description...

BELL-CVE-2024-36013

Bulletin has no description...

BELL-CVE-2024-36012

Bulletin has no description...

CVE-2023-6502 Inefficient Regular Expression Complexity in GitLab

A Denial of Service DoS condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page...

Code Injection

litellm is vulnerable to Code Injection. The vulnerability is due to unsafe usage of the eval function in the litellm.getsecret method, where untrusted data is passed to eval without sanitization...

Remote Code Execution (RCE)

passbolt/passboltapi is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper input sanitization during the server's PGP key generation, allowing users to inject shell code during installation...