CVE-2022-46177

Discourse vulnerability CVE-2022-46177 affects Discourse versions prior to 2.8.14 (stable) and prior to 3.0.0.beta15 (beta/tests-passed). If a user requests a password-reset link and then changes the primary email, the old reset email can remain valid; using it to reset the password re-links the ...

Information Exposure

Overview pghero is a performance dashboard for Postgres. Affected versions of this package are vulnerable to Information Exposure via the explain functionality, due to improper validation of the user query, which might result in data leakage from the query error message. Remediation Upgrade pgher...

PYSEC-2023-19

A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address...

PT-2023-12407 · Shannah · Xataface

Name of the Vulnerable Software and Affected Versions: shannah Xataface versions up to 2.x Description: A problematic issue has been found in the function testftp of the file install/install form.js.php of the component Installer, leading to cross site scripting. The attack may be launched...

PT-2023-15891 · Snoyberg · Keter

Name of the Vulnerable Software and Affected Versions: snoyberg keter versions up to 1.8.1 Description: A vulnerability has been found in snoyberg keter, classified as problematic. This issue affects unknown code of the file Keter/Proxy.hs. The manipulation of the argument host leads to cross-sit...

Cross site scripting

A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to...

CVE-2021-4297 trampgeek jobe Restapi.php runs_post Privilege Escalation

A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runspost of the file application/controllers/Restapi.php. The manipulation of the argument sourcefilename leads to an unknown weakness. Upgrading to version 1.6.5 is...

PT-2022-28120 · Mellium · Mellium.Im/Sasl

Name of the Vulnerable Software and Affected Versions: Mellium mellium.im/sasl versions prior to 0.3.1 Description: An issue was discovered in Mellium mellium.im/sasl when performing SCRAM-based SASL authentication. If the remote end advertises support for channel binding, no random nonce is...

PT-2022-8022 · Unknown · Ariadne Component Library

Name of the Vulnerable Software and Affected Versions: Ariadne Component Library versions up to 2.x Description: A critical issue has been found, affecting an unknown function of the file src/url/Url.php. This issue leads to server-side request forgery. Recommendations: For Ariadne Component...

GHSA-9P62-X3C5-HR5P Path Traversal In MeterSpere leads to upload file to any path

Summary MeterSphere allow users to upload file, but not check the file name, may lead to upload file to any path if the file name in upload request is falsified. Details Metersphere's FileUtils.java didn't check the filePath. java public static void createFileString filePath, byte fileBytes File...

Path Traversal In MeterSpere leads to upload file to any path

Summary MeterSphere allow users to upload file, but not check the file name, may lead to upload file to any path if the file name in upload request is falsified. Details Metersphere's FileUtils.java didn't check the filePath. java public static void createFileString filePath, byte fileBytes File...

OESA-2022-2166 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse,forward and transparent proxy and cache. Security Fixes: Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain...

CVE-2020-36635 OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting

A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. The manipulation lead...

UBUNTU-CVE-2021-4286

A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculatex of the file srp/ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. T...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies. PoC javascript const ...

UBUNTU-CVE-2015-10005

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/htmlre.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of t...

PT-2022-9019 · Ahorner · Text-Helpers

Name of the Vulnerable Software and Affected Versions: ahorner text-helpers versions up to 1.0.x ahorner text-helpers versions 1.1.0 through 1.1.1 Description: A critical issue affects the unknown code of the file lib/text helpers/translation.rb. The manipulation of the link argument leads to the...

PT-2022-16071 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions prior to 4.2.11 Description: This issue may allow attackers to spoof their IP address when the server is behind a reverse proxy. Recommendations: For versions prior to 4.2.11, upgrade to version 4.2.11 or later, and...

PT-2022-16061

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions =8.5.1 Description The issue arises from the lack of algorithm definition in the jwt.verify function, leading to a signature validation bypass due to defaulting to the none algorithm for signature verification. This occur...

CVE-2021-4268 phpRedisAdmin cross-site request forgery

A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of...