Lucene search
+L
GithubMost viewed

35598 matches found

Github Security Blog
Github Security Blog
added 2020/09/01 4:03 p.m.59 views

Local Privilege Escalation in npm

Affected versions of npm use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the npm process has permission to write t...

3.3CVSS3.7AI score0.00372EPSS
SaveExploits0References11Affected Software1
Github Security Blog
Github Security Blog
added 2020/08/31 10:56 p.m.59 views

Content Injection in remarkable

Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link protocols, and consequently allowed javascript: to be used. Proof of Concept Markdown Source: link Rendered HTML: li...

6.1CVSS5.7AI score0.00973EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2020/08/28 8:48 p.m.59 views

Cross Site Scripting in baserCMS

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS. Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree.js Tested...

7.3CVSS2.2AI score0.01011EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2020/08/19 7:52 p.m.59 views

Remote Code Execution in SyliusResourceBundle

Impact Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. The vulnerable versions...

9.6CVSS4.3AI score0.02149EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2020/07/07 12:01 a.m.59 views

Context isolation bypass via leaked cross-context objects in Electron

Impact Apps using contextIsolation are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your...

9CVSS4.7AI score0.00367EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2020/06/10 9:12 p.m.59 views

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider aka apache/commons-proxy...

8.8CVSS3.5AI score0.03673EPSS
SaveExploits0References10Affected Software1
Github Security Blog
Github Security Blog
added 2019/08/06 1:43 a.m.59 views

Allocation of Resources Without Limits or Throttling in Apache Tika

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later...

8.8CVSS2.4AI score0.0484EPSS
SaveExploits0References10Affected Software1
Github Security Blog
Github Security Blog
added 2019/06/27 5:25 p.m.59 views

Cross-Site Scripting via JSONP

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors...

4.2AI score
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2019/06/07 8:56 p.m.59 views

Code Injection in PyXDG

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDGCONFIGDIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in...

7.5CVSS3.6AI score0.02105EPSS
SaveExploits1References7Affected Software1
Github Security Blog
Github Security Blog
added 2019/03/25 6:03 p.m.59 views

jackson-databind Deserialization of Untrusted Data vulnerability

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Jodd-db jar for database access for the Jodd framework in the classpath, and an attacker can provide an LDAP...

7.5CVSS8.7AI score0.07348EPSS
SaveExploits0References40Affected Software1
Github Security Blog
Github Security Blog
added 2019/01/04 5:45 p.m.59 views

PyYAML insecurely deserializes YAML strings leading to arbitrary code execution

In PyYAML before 5.1, the yaml.load API could execute arbitrary code. In other words, yaml.safeload is not used. This was intended to be fixed in 4.1, but due to breaking changes, 4.1 was yanked and 5.1 contains the patch for CVE-2017-18342...

9.8CVSS7.1AI score0.05656EPSS
SaveExploits2References14Affected Software1
Github Security Blog
Github Security Blog
added 2018/07/13 3:16 p.m.59 views

Code injection in ansible

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

7.8CVSS5AI score0.02991EPSS
SaveExploits1References8Affected Software1
Github Security Blog
Github Security Blog
added 2017/10/24 6:33 p.m.59 views

actionpack vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the numbertocurrency helper in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter...

4.3CVSS5.5AI score0.03171EPSS
SaveExploits0References18Affected Software1
Github Security Blog
Github Security Blog
added 2026/08/07 3:10 p.m.58 views

Smarty Security stream restriction bypass through stream: resource

smarty/smarty version 5.8.0 can read local files through PHP stream wrappers even when Smarty Security is enabled and all streams are disabled with Security::$streams = null. The bypass uses Smarty's built-in stream: resource type. A template such as: smarty include...

6.9CVSS5.5AI score0.00419EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/07/17 4:52 p.m.58 views

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

Issue Description Librosa defaults to using numpy.mean for mono downmixing tomono, while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in: - Inconsistency between audio heard by humans e.g., through headphones/regular speakers and...

7.1CVSS5.3AI score0.00267EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/15 5:35 p.m.58 views

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

Summary Nodemailer's disableFileAccess and disableUrlAccess options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME streaming path enforces those options in MimeNode.getStream. However, jsonTransport serializes messages by calling...

5.5AI score
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/05/19 2:35 p.m.58 views

Algernon: Single-file mode unconditionally enables debug mode

Summary When Algernon is invoked with a single file path instead of a directory — the documented "quick demo" workflow algernon foo.lua, algernon page.po2, algernon index.html, algernon mywebsite.alg — singleFileMode is set to true and debugMode is forcibly enabled with no opt-out: go //...

7.5CVSS5.8AI score0.00303EPSS
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/05/08 5:02 p.m.58 views

MCP Registry has open redirect via protocol-relative path in trailing-slash middleware

Summary The TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path e.g., //evil.com/ that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an...

5.8AI score0.0041EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2026/04/25 11:51 p.m.58 views

OpenClaw: Agent gateway config mutations could change protected operator settings

Affected Packages / Versions - Package: openclaw npm - Affected versions: 2026.4.20 - Patched version: 2026.4.20 Impact The agent-facing gateway config.patch / config.apply guard did not cover several operator-trusted settings, including sandbox policy, plugin enablement, gateway auth/TLS, hook...

5.4AI score
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2025/11/27 3:30 a.m.58 views

Ray's New Token Authentication is Disabled By Default

Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces including the dashboard and Jobs API is disabled unless explicitly enabled by setting RAYAUTHMODE=token. In the default unauthenticated state, a remote attacker with...

8.2AI score0.00474EPSS
SaveExploits5References10Affected Software1
Github Security Blog
Github Security Blog
added 2025/07/21 7:04 p.m.58 views

form-data uses unsafe random function in form-data for choosing boundary

Summary form-data uses Math.random to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker: 1. can observe other values produced by Math.random in the target application, and 2. can control one field of a request made using form-data Because th...

9.4CVSS7.1AI score0.01769EPSS
SaveExploits1References6Affected Software1
Github Security Blog
Github Security Blog
added 2025/05/29 4:50 p.m.58 views

Fabio allows HTTP clients to manipulate custom headers it adds

Summary Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should...

9.1CVSS7.4AI score0.00487EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2025/04/04 2:07 p.m.58 views

GraphQL query operations security can be bypassed

Summary Using the Relay special node type you can bypass the configured security on an operation. Details Here is an example of how to apply security configurations for the GraphQL operations: php ApiResource security: "isgranted'ROLEUSER'", operations: / ... / , graphQlOperations: new...

7.5CVSS7.4AI score0.00458EPSS
SaveExploits0References9Affected Software2
Github Security Blog
Github Security Blog
added 2024/09/10 7:41 p.m.58 views

express vulnerable to XSS via response.redirect()

Impact In express 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect may execute untrusted code Patches this issue is patched in express 4.20.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issu...

5CVSS6.8AI score0.00486EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2024/09/03 7:45 p.m.58 views

Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability CVE-2024-45048. To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, pleas...

8.8CVSS6.8AI score0.00605EPSS
SaveExploits1References3Affected Software3
Github Security Blog
Github Security Blog
added 2024/08/20 6:31 p.m.58 views

Grafana plugin data sources vulnerable to access control bypass

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...

5.4CVSS6.9AI score0.00305EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2024/08/09 9:23 p.m.58 views

OpenFGA Authorization Bypass

Overview OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses but not and from expressions and a userset. Fix - If you are using OpenFGA within Docker or as a Go library, as a binary, or through Docker, upgrade to v1.5.9 as soon as possibl...

9.8CVSS7.5AI score0.00527EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2024/08/02 9:12 p.m.58 views

Reposilite artifacts vulnerable to Stored Cross-site Scripting

Summary Reposilite v3.5.10 is affected by Stored Cross-Site Scripting XSS when displaying artifact's content in the browser. Details As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The...

7.1CVSS6.8AI score0.00828EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2024/07/05 8:03 p.m.58 views

ZITADEL Vulnerable to Session Information Leakage

Impact ZITADEL provides users the ability to list all user sessions of the current user agent browser by API and in the Console UI. Due to a missing check, user sessions without that information e.g. when created though the session service were incorrectly listed exposing potentially other user's...

6.5CVSS6.5AI score0.00609EPSS
SaveExploits0References12Affected Software1
Github Security Blog
Github Security Blog
added 2024/06/10 9:38 p.m.58 views

@grpc/grpc-js can allocate memory for incoming messages well above configured limits

Impact There are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded. 2. If an...

5.3CVSS7.2AI score0.00671EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2024/06/04 12:31 p.m.58 views

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

8.8CVSS8.8AI score0.00618EPSS
SaveExploits1References3Affected Software1
Github Security Blog
Github Security Blog
added 2024/05/15 10:03 p.m.58 views

Read private customer data reclaiming carts in Klaviyo Magento

A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API...

6.9AI score
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2024/04/25 7:50 p.m.58 views

vyper performs multiple eval of `sqrt()` argument built in

Summary Using the sqrt builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult but not impossible! to trigger as of 0.3.4, when the unique symbol fence was introduced https://github.com/vyperlang/vyper/pull/2914. A contract sear...

5.3CVSS5.4AI score0.00455EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2024/04/17 6:21 p.m.58 views

.NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2024-21409 | .NET Elevation of Privilege Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 ,and .NET 8.0. This advisory also provides guidance on what developers can do t...

7.3CVSS7.3AI score0.02513EPSS
SaveExploits0References5Affected Software3
Github Security Blog
Github Security Blog
added 2024/03/22 3:31 p.m.58 views

Cross-site Scripting in Moodle Chat

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

5.4CVSS6.5AI score0.00551EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2024/03/12 6:31 p.m.58 views

Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server

Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability...

8.8CVSS8.5AI score0.02106EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2024/02/29 3:33 a.m.58 views

json-jwt allows bypass of identity checks via a sign/encryption confusion attack

The json-jwt aka JSON::JWT gem 1.16.x before 1.16.6, 1.15.x before 1.15.3.1 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...

8.4CVSS6.3AI score0.00233EPSS
SaveExploits1References8Affected Software1
Github Security Blog
Github Security Blog
added 2024/02/02 8:43 p.m.58 views

PHPMailer Local file inclusion

Impact Arbitrary local file inclusion via the $lang property, remotely exploitable if host application passes unfiltered user data into that property. The 3 CVEs listed are applications that used PHPMailer that were vulnerable to this problem. Patches It's not known exactly when this was fixed in...

7.5CVSS6.3AI score0.01435EPSS
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2024/01/22 3:30 a.m.58 views

SQL injection in llama-index

LlamaIndex aka llamaindex through 0.9.35 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

9.8CVSS7.8AI score0.0066EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
added 2024/01/11 4:30 p.m.58 views

Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

Summary The Home Preference page exposes a small list of nginx settings such as Nginx Access Log Path and Nginx Error Log Path. However, the API also exposes testconfigcmd, reloadcmd and restartcmd. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sendi...

8.8CVSS7.1AI score0.01537EPSS
SaveExploits1References8Affected Software1
Github Security Blog
Github Security Blog
added 2023/12/05 3:30 p.m.59 views

Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/friendlink/update...

8.8CVSS7.5AI score0.00391EPSS
SaveExploits1References3Affected Software1
Github Security Blog
Github Security Blog
added 2023/11/20 9:00 p.m.58 views

Cookies are sent to external images in rendered diff (and server side request forgery)

Impact The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that...

9CVSS6.7AI score0.0071EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2023/11/14 6:27 p.m.58 views

Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.9.2post0 and was tested on version 1.8.2. Overview In all current versions of Label Studio, the application allow...

7.5CVSS7AI score0.04055EPSS
SaveExploits3References5Affected Software1
Github Security Blog
Github Security Blog
added 2023/11/08 2:51 p.m.58 views

XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu

Impact XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name ...

9.6CVSS7.3AI score0.02191EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2023/10/25 9:30 p.m.58 views

Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the...

8.8CVSS8AI score0.56605EPSS
SaveExploits2References6Affected Software1
Github Security Blog
Github Security Blog
added 2023/10/10 6:31 p.m.58 views

Apache Tomcat Incomplete Cleanup vulnerability

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened ...

5.9CVSS6.7AI score0.01854EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2023/09/24 3:30 a.m.58 views

kube-apiserver authentication bypass vulnerability

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...

8CVSS7AI score0.01569EPSS
SaveExploits0References11Affected Software1
Github Security Blog
Github Security Blog
added 2023/09/06 3:30 p.m.58 views

Apache Superset Deserialization of Untrusted Data vulnerability

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...

6.6CVSS7.1AI score0.35455EPSS
SaveExploits2References4Affected Software1
Github Security Blog
Github Security Blog
added 2023/09/01 8:51 p.m.58 views

tss-lib leaks secret keys in response to incorrectly constructed Paillier moduli

Impact The specification of the GG18 threshold ECDSA signature protocol contains a vulnerability allowing an attacker to recover the shared secret key. If a participant generates a Paillier modulus N containing small factors less than 2^100 they can interact with other participants in the signing...

6.7AI score
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2023/08/31 12:30 a.m.58 views

Path traversal in Zip Swift

An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry...

7.8CVSS7AI score0.00447EPSS
SaveExploits1References6Affected Software1
Total number of security vulnerabilities5000