Cross-site scripting vulnerability in file upload

There is a cross-site scripting vulnerability in file upload on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible...

Free of uninitialized memory in telemetry

An issue was discovered in the telemetry crate through 0.1.2 for Rust. There is a drop of uninitialized memory if a value.clone call panics within misc::vecwithsize...

Widget feature vulnerability allowing to execute JavaScript code using undo functionality

Affected packages The vulnerability has been discovered in Widget plugin if used alongside Undo feature. Impact A potential vulnerability has been discovered in CKEditor 4 Widget package. The vulnerability allowed to abuse undo functionality using malformed widget HTML, which could result in...

Out-of-bounds write in ChakraCore

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827,...

Improper Authenication in Pion DTLS

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion...

Form validation can be skipped

Impact By crafting a special GET request containing a valid form state, a form can be submitted without invoking any validators. We consider the severity low because it is not possible to change any form values since the form state is secured with an HMAC that is still verified. That means that...

Origin Validation Error in Apache Maven

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

Remote Code Execution via traversal in TAL expressions

This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Impact Most Python modules are not available for using in TAL expressions that you can add...

Prototype pollution in Merge-deep

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library...

Incorrect handling of credential expiry by /nats-io/nats-server

This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26892.txt Problem Description NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled. The NATS accounts system has expiration timestamps on credentials; the library had an...

Rancher Vulnerable to Cross-site Request Forgery (CSRF)

Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is...

Improper Access Control in Lightning Network Daemon

Lightning Network Daemon lnd before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control...

Code injection in keycloak

A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Prototype Pollution in doc-path

This affects the package doc-path before 2.1.2...

Regular expression denial of service in @absolunet/kafe

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails...

Path Traversal in marscode

This affects all versionsup to and including version 1.0.1-0 of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js...

Buffer overflow in canvas

A buffer overflow is present in canvas versions before 1.6.11, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image...

Code injection in mock2easy

This affects all versions up to and including version 0.0.24 of package mock2easy. a malicious user could inject commands through the data variable: Affected Area js require'../server/getJsonByCurl'mock2easy, functionerror, stdout if error return res.json500, error; res.jsonJSON.parsestdout; , ''...

Prototype Pollution in gedi

All versions of package gedi up to and including version 1.6.3 are vulnerable to Prototype Pollution via the set function...

Prototype Pollution in node-oojs

All versions of package node-oojs up to and including version 1.4.0 are vulnerable to Prototype Pollution via the setPath function...

Prototype Pollution in deeps

All versions of package deeps up to and including version 1.4.5 are vulnerable to Prototype Pollution via the set function...

Improper Authentication in Apache Hadoop

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled...

Cross-site Scripting in GwtUpload

The file-upload feature in GwtUpload 1.0.3 allows XSS via a crafted filename...

LDAP Injection in is-user-valid

All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure...

Out-of-bounds write in Microsoft.ChakraCore

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1141, CVE-2019-1195, CVE-2019-1196...

Cross-site Scripting (XSS) in moodle

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10...

Prototype Pollution in y18n

Overview The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution. POC js const y18n = require'y18n'; y18n.setLocale'proto'; y18n.updateLocalepolluted: true; console.logpolluted; // true Recommendation Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later...

Pillow Uncontrolled Resource Consumption

Pillow before 8.1.2 allows attackers to cause a denial of service memory consumption because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large...

/user/sessions endpoint allows detecting valid accounts

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...

botframework-connector vulnerable to Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see the...

Open redirect in Slashify

The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, bookings/latest/ to bookings/latest. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes or two backslashes, or a...

Mautic users able to download any files from server using filemanager

Impact Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session must be logged into Mautic to use the Filemanager to download any file from the server that the web user has access to. Patches Update to 2.12.0 or later. Workarounds None For more information If y...

ReDOS vulnerabities: multiple grammars

Impact: Potential ReDOS vulnerabilities exponential and polynomial RegEx backtracking oswasp: The Regular expression Denial of Service ReDoS is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very...

RCE in Symfony

Description ----------- The CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surroga...

Cross Site Scripting(XSS) Vulnerability in Latest Release 4.3.6 Site basic settings

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7...

Cross-site Scripting in dijit editor's LinkDialog plugin

Impact XSS possible for users of the Dijit Editor's LinkDialog plugin Patches Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3 Workarounds Users may apply the patch made in these releases. For more information If you have any questions or comments about this advisory, open an issue in dojo/di...

Arbitrary file write in actionpack-page_caching gem

There is a vulnerability in actionpackpage-caching gem v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view...

Information disclosure in the Contao backend

Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If...

Improper Certificate Validation in urllib3

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...

SQLAlchemy is vulnerable to SQL Injection via group_by parameter

SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled...

Path Traversal in Action View

File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents. Th...

Malware in cordova-plugin-geofence-appit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

Impact undici's EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data: fields with no blank event separator, or a single unfinished line split across many chunks, the parser retains a growing...

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the tool-continuation re-submission has omitted the salt. Summary On the GPT-OSS "Harmony" path POST...

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

Summary The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured...

rubyzip path traversal vulnerability

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Vulnerability Details File: node.js Function: normalizeStats line 214, reached from getStat called unconditionally on every browserslist call and loadStat Root Cause js function normalizeStatsdata, stats if !data data = if stats && 'dataByBrowser' in stats stats = stats.dataByBrowser if typeof...

Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Summary An unauthenticated POST to any OpenAPI-validated endpoint, including the anonymous POST /edge/validate and POST /edge/issue-token, crashes the entire Unleash server with one request body of deeply-nested JSON. When request-body validation fails, Unleash builds the error message by calling...

Snowflake Connector for Python improperly verifies TLS hostnames

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...