PT-2023-21862 · H2 +2 · H2 +3

Name of the Vulnerable Software and Affected Versions: GoCD versions 20.5.0 through 23.1.0 Description: The issue arises when the server environment is not correctly configured to provide access to the relevant PostgreSQL or MySQL backup tools, potentially leaking database access credentials to...

Apache InLong 代码问题漏洞

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A deserialization vulnerability exists in Apache InLong versions 1.1.0 to 1.5.0. The vulnerability stems from unsafe deserializatio...

abs-auth-rbac-core (>=0.1.15 <=0.5.4), airdot (>=0.3.0b0 <=0.6.0b0) +45 more potentially affected by CVE-2023-28858 via redis (>=4.5.0 <=4.5.2)

redis PYPI version =4.5.0, =0.1.15, =0.3.0b0, =23.2.9, =1.1.87, =0.0.25, =1.1.0, =1.0.0, =0.13.0, =1.0.0, =0.3.0, =4.7.0, =4.7.3 and more Source cves: CVE-2023-28858 Source advisory: OSV:PYSEC-2023-45...

abs-auth-rbac-core (>=0.1.15 <=0.5.4), airdot (>=0.3.0b0 <=0.6.0b0) +48 more potentially affected by CVE-2023-28859 via redis (>=4.5.0 <=4.5.3)

redis PYPI version =4.5.0, =0.1.15, =0.3.0b0, =23.2.9, =1.1.87, =0.0.25, =1.1.0, =1.0.0, =0.13.0, =1.0.0, =0.3.0, =1.1.38, =1.1.50, =1.1.74 and more Source cves: CVE-2023-28859 Source advisory: OSV:PYSEC-2023-46...

@550w-tools/cli (>=0.0.14 <=0.0.16), @550w-tools/core (>=0.0.14 <=0.0.16) +538 more potentially affected by CVE-2023-26122 via safe-eval (>=0.2.0 <=0.4.1)

safe-eval NPM version =0.2.0, =0.0.14, =0.0.14, =0.0.13, =0.0.14, =0.0.15, =1.0.1, =1.0.2, =1.0.3, =1.1.2, =0.1.16, =1.0.0, =0.3.0, =0.20.0, =2.0.295, =2.0.315 and more Source cves: CVE-2023-26122 Source advisory: SNYK:JS-SAFEEVAL-3373064...

a2grunnerp (>=0.1.0 <=0.1.8), abba-python (>=0.1.6 <=0.3.0) +607 more potentially affected by CVE-2023-25676 via tensorflow (>=1.0.1 <=2.11.0rc2)

tensorflow PYPI version =1.0.1, =0.1.0, =0.1.6, =1.1.2, =0.0.1, =0.3.26, =1.1.0, =0.0.1, =0.2.0, =0.3.1, =0.5.1 and more Source cves: CVE-2023-25676 Source advisory: OSV:GHSA-6WFH-89Q8-44JQ...

Faveo Helpdesk SQL注入漏洞

Faveo Helpdesk is an open source ticketing system built by Faveo based on Laravel framework. A security vulnerability exists in Faveo Helpdesk versions 1.0 through 1.11.1, which stems from a controlled parameter passed from the front-end of the login box to the back-end, resulting in an SQL...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0 <=4.4.0.1), ai.dev-tools:ai-devtools (>=0.1.12 <=0.1.20) +35841 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (>=3.0.0.RELEASE <=5.2.22.RELEASE)

org.springframework:spring-expression MAVEN version =3.0.0.RELEASE, =4.4.0.0, =0.1.12, =0.1.6, =0.1.8, =0.1.6, =0.1.2, =0.0.6, =0.0.11, =0.0.16, =0.0.1, =0.0.47, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.21 and more Source cves: CVE-2023-20861 Source advisory: OSV:GHSA-564R-HJ7V-MCR5...

ai.optfor:spring-openai-api (>=0.1.3 <=0.3.25), ai.superstream:spring-kafka (=3.0.1-alpha1) +8490 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (>=6.0.0 <=6.0.6)

org.springframework:spring-expression MAVEN version =6.0.0, =0.1.3, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =0.0.6, =0.0.6, =1.3.0, =4.5.0, =4.0.0, =4.0.3 - be.jidoka:jdk-keycloak-admin =2.0.0 and more Source cves: CVE-2023-20861 Source advisory: OSV:GHSA-564R-HJ7V-MCR5...

Couchbase Server 访问控制错误漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in Couchbase Server versions 5.x through 7.x prior to 7.1.4, which stems from access...

PT-2023-10823

Name of the Vulnerable Software and Affected Versions zwczou WeChat SDK Python versions 0.3.0 through 0.5.4 Description A critical issue affects the validate/to xml function, leading to xml external entity reference. The attack may be initiated remotely. Recommendations To address this issue,...

FasterXML jackson-databind 安全漏洞

FasterXML jackson-databind is FasterXML company based on a JAVA can be XML and JSON and other data formats and JAVA objects for the conversion of the library . Jackson can be easily converted into Java objects and json objects and xml documents , the same can be json, xml conversion into Java...

CVE-2020-4927

A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191695...

PT-2023-2201 · Eclipse · Eclipse Birt

Name of the Vulnerable Software and Affected Versions: Eclipse BIRT versions 2.6.2 through 4.12 Description: The issue is related to insufficient input validation when processing host headers with the report parameter. This could allow a remote attacker to gain unauthorized access to protected...

agent-memory-layer (>=0.1.0 <=0.1.1), astonish (>=0.12.2 <=0.12.5) +3 more potentially affected by CVE-2023-25617 via sap-ai-sdk-base (>=3.1.2 <=3.4.0)

sap-ai-sdk-base PYPI version =3.1.2, =0.1.0, =0.12.2, =1.0.25122300, =3.0.3, =5.3.4, =6.10.0 Source cves: CVE-2023-25617 Source advisory: OSV:PYSEC-2023-315...

CVE-2022-31474

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1...

PT-2023-21225 · Maddy · Maddy

Name of the Vulnerable Software and Affected Versions: maddy versions 0.2.0 through 0.6.2 Description: The issue allows for a full authentication bypass if a SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it i...

Jenkins 跨站脚本漏洞

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins versions 2.270 through 2.393. An attacker exploited the vulnerability to execu...

@adobe/target-decisioning-engine (>=1.0.0 <=1.5.1), @agriyadev5/react-jsonschema-form (>=1.8.1 <=1.8.3) +132 more potentially affected by CVE-2021-4329 via json-logic-js (>=1.0.9 <=1.2.3)

json-logic-js NPM version =1.0.9, =1.0.0, =1.8.1, =2.29.12, =0.1.7, =1.0.4, =0.2.52, =0.0.1, =4.11.1-rc.8, =3.0.0-rc.23, =3.29.6-1, =3.1.12-1, =3.29.7-12, =3.29.15 and more Source cves: CVE-2021-4329 Source advisory: OSV:GHSA-67J4-2MH6-8627...

CVE-2020-5026

IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM...