CVE-2023-40394

The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to access sensitive user data...

CVE-2023-40394

The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to access sensitive user data...

Mars: Sensitive Information Exposed at █████

Sensitive information was exposed in a JavaScript file, revealing configuration details, credentials, and file paths related to the deployment of a JavaScript application. This could enable unauthorized access to sensitive data...

PT-2024-12623 · Gtkwave · Gtkwave

Name of the Vulnerable Software and Affected Versions: GTKWave version 3.3.115 Description: The issue is related to out-of-bounds read vulnerabilities in the VCD var definition section functionality. A specially crafted .vcd file can lead to arbitrary code execution when opened. This can be...

Code Execution

teleport is vulnerable to Code Execution. The vulnerability is due to improper validation on user supplied environment variables. This issue can be exploited by an attacker to execute arbitrary code on the MacOS systems...

GHSA-VFXF-76HV-V4W4 Withdrawn Advisory: User-provided environment values allow execution on macOS agents

Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects a binary, not a library in a supported ecosystem. Therefore, users of the library should not receive alerts. This link is maintained to preserve external references. Original Description Impact Agents running on...

Withdrawn Advisory: User-provided environment values allow execution on macOS agents

Withdrawn Advisory This advisory has been withdrawn because the vulnerability affects a binary, not a library in a supported ecosystem. Therefore, users of the library should not receive alerts. This link is maintained to preserve external references. Original Description Impact Agents running on...

GitLab 12.0 < 14.10.5 / 15.0 < 15.0.4 / 15.1 < 15.1.1 (CVE-2022-2228)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Information exposure in GitLab EE affecting all versions from 12.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker with the appropriate access tokens to obtain CI...

GitLab 13.7 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22252)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variables which should only be accessible to Maintainers...

PT-2024-40475 · Teleport · Teleport

Name of the Vulnerable Software and Affected Versions: Teleport versions prior to 12.4.31 Teleport versions prior to 13.4.13 Teleport versions prior to 14.2.4 Description: The issue affects agents running on macOS, making them susceptible to unexpected code execution through user-supplied...

Potential Actions command injection in output filenames (GHSL-2023-275)

Summary The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. Details The verify-changed-files workflow returns the list of files changed within a workflow execution. This could...

GHSA-2X7R-93WW-CXRQ Winter CMS Local File Inclusion through Server Side Template Injection

Impact Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. By default, only th...

Stack overflow

A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtionetflushtx function if guest features VIRTIONETFHASHREPORT, VIRTIOFVERSION1 and VIRTIONETFMRGRXBUF are enabled. This could allow a malicious user to overwrite local variables...

CVE-2023-6693

A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtionetflushtx function if guest features VIRTIONETFHASHREPORT, VIRTIOFVERSION1 and VIRTIONETFMRGRXBUF are enabled. This could allow a malicious user to overwrite local variables...

Information Disclosure

GitLab EE is vulnerable to Information Disclosure.The vulnerability is caused due to improper authorization. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom project templates...

The vulnerability of the Incognito mode in Mozilla Firefox and Firefox ESR browsers relates to the use of uninitialized variables, which allows a hacker to disclose protected information.

The vulnerability of the Incognito mode in Mozilla Firefox and Firefox ESR browsers is related to the use of uninitialized variables. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

Improper Access Control

apacheairflow is vulnerable to Improper Access Control. The vulnerability is due to the variablesimport function within variablecommand.py and the varimport function within views.py. These functions lack permission checks and have inadequate handling of existing variables during imports, allowing...

Apache Airflow 访问控制错误漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.8.0,...

Buffer Overwrite

vyper is vulnerable to Buffer Overwrite. The vulnerability exists due to an incorrect calculation for storage slots containing large arrays which allows an attacker to overwrite storage variables exceeding the allocated space...

CVE-2023-5061

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the...