CVE-2023-41338 Vulnerability in Ctx.IsFromLocal() in gofiber

Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could...

CVE-2023-40587

Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of t...

CVE-2023-40587

Pyramid (Python web framework) versions 2.0.0–2.0.1 are affected by a directory-traversal vulnerability in a Pyramid static view that can disclose index.html located one directory above the static view path when accessed with Python 3.11. The issue stems from os.path.normpath behavior and affects...

CVE-2023-40587 Pyramid static view path traversal up one directory

Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of t...

Pear Admin Think SQL Injection Vulnerability

Pear Admin Think is open source rapid development platform based on thinkphp6, with simple code generation features, you can quickly build your functional business. A security vulnerability exists in Pear Admin Think version 2.1.2, which stems from a vulnerability that allows an attacker to execu...

Gin-Gonic Gin 安全漏洞

Gin-Gonic Gin is a Go-based framework for rapidly building web applications from the Gin-Gonic team. A security vulnerability exists in Gin-Gonic Gin, which stems from the filename parameter of the Context.FileAttachment function not being cleaned up correctly...

[SECURITY] [DSA 5442-1] flask security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5442-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 29, 2023 https://www.debian.org/security/faq -...

GHSA-VJ2M-9F5J-MPR5 Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware

Vapor is an HTTP web framework for Swift and middleware is a logic chain between the client and a Vapor route handler. FileMiddleware enables the serving of assets from the Public folder of a project to the client. Vapor before 4.60.3 is vulnerable to denial of service due to an integer overflow...

Vapor vulnerable to denial of service in URLEncodedFormDecoder

Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder. Impact When using automatic content decoding, e.g. swift app.post"foo" request - String in let foo = try request.content.decodeFoo.self return "\foo" An...

Vapor vulnerable to denial of service in URLEncodedFormDecoder

Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder...

Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware

Vapor is an HTTP web framework for Swift and middleware is a logic chain between the client and a Vapor route handler. FileMiddleware enables the serving of assets from the Public folder of a project to the client. Vapor before 4.60.3 is vulnerable to denial of service due to an integer overflow...

Cross site scripting

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework CVE-2019-8331 and build a stored cross-site scripting XSS payload...

CVE-2023-32711

The CVE-2023-32711 entry concerns Splunk Enterprise, where versions prior to 9.0.5, 8.2.11, and 8.1.14 expose a stored XSS via a dashboard view due to a vulnerability in Bootstrap (CVE-2019-8331). The issue allows a low-privilege user to craft a stored XSS payload that can be executed in the cont...

CVE-2023-32711 Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework CVE-2019-8331 and build a stored cross-site scripting XSS payload...

Input validation

CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they...

CVE-2023-32692 Remote Code Execution Vulnerability in Validation Placeholders

CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they...

CVE-2023-32692

CodeIgniter4 contains a Remote Code Execution vulnerability in the Validation placeholders handled by the Validation library (affecting validation in controllers/models). The issue allows arbitrary code execution and is addressed by upgrading to version 4.3.5 or later. Connected sources corrobora...

CodeIgniter 代码注入漏洞

CodeIgniter is an open source web framework written in the PHP language. A security vulnerability exists in CodeIgniter versions prior to 4.3.5 that stems from a problem with the validation method and in-model validation in the controller, allowing an attacker to execute arbitrary code...

USN-6111-1: Flask vulnerability

It was discovered that Flask incorrectly handled certain data responses. An attacker could possibly use this issue to expose sensitive information...

NFine Rapid Development Platform 安全漏洞

NFine Rapid Development Platform is a C-based, blazing-fast WEB + ORM framework for individual NFine developers. A security vulnerability exists in NFine Rapid Development Platform that originates from /SystemManage/User/GetGridJson?search=false&nd=1680855479750&rows=50&page=1&sidx=F...