Lucene search
+L
GithubMost viewed

35598 matches found

Github Security Blog
Github Security Blog
added 2021/03/18 7:27 p.m.59 views

Privilege Context Switching Error in Elasticsearch

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documen...

3.5CVSS4.8AI score0.01011EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2021/03/01 7:52 p.m.59 views

Denial of service in prismjs

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service ReDoS via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components...

7.5CVSS7.5AI score0.03167EPSS
SaveExploits1References9Affected Software1
Github Security Blog
Github Security Blog
added 2021/02/08 7:16 p.m.59 views

Code Injection vulnerability in CarrierWave::RMagick

Impact CarrierWave::RMagick has a Code Injection vulnerability. Its manipulate! method inappropriately evals the content of mutation option:read/:write, allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, i...

8.8CVSS1.7AI score0.12678EPSS
SaveExploits1References8Affected Software1
Github Security Blog
Github Security Blog
added 2021/01/20 9:21 p.m.59 views

Prototype pollution in JointJS

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath. The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution...

9.8CVSS8.8AI score0.01359EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
added 2020/12/21 6:01 p.m.59 views

Jupyter Server open redirect vulnerability

Impact What kind of vulnerability is it? Who is impacted? Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers running without a baseurl prefix are technically affected, however, these maliciously craft...

6.1CVSS6.3AI score0.01362EPSS
SaveExploits1References8Affected Software1
Github Security Blog
Github Security Blog
added 2020/12/02 6:28 p.m.59 views

XXE in petl

Impact Information Disclosure Summary petl is a Python library that provides functions for extraction, transformation, and loading ETL of data. petl before 1.68, in some configurations, allows resolution of entities in XML input. An attacker who is able to submit XML input to an application using...

9.8CVSS0.5AI score0.02323EPSS
SaveExploits0References11Affected Software1
Github Security Blog
Github Security Blog
added 2020/10/06 2:24 p.m.59 views

Unpreventable top-level navigation

Impact The will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. Patches 11.0.0-beta.1 10.0.1 9.3.0 8.5.1 Workarounds Sandbox all your iframes using the...

7.5CVSS2.3AI score0.01351EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2020/09/25 6:28 p.m.59 views

Denial of Service in Tensorflow

Impact The SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix:...

6.3CVSS2.6AI score0.00726EPSS
SaveExploits1References8Affected Software3
Github Security Blog
Github Security Blog
added 2020/09/01 9:22 p.m.59 views

Entropy Backdoor in text-qrcode

All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being...

1.4AI score
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2020/09/01 6:57 p.m.59 views

Tracking Module in botbait

The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. - Source IP - process.versions - process.platform - How the module was invoked test, requir...

5.3CVSS3.1AI score0.0088EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2020/09/01 4:03 p.m.59 views

Local Privilege Escalation in npm

Affected versions of npm use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the npm process has permission to write t...

3.3CVSS3.7AI score0.00372EPSS
SaveExploits0References11Affected Software1
Github Security Blog
Github Security Blog
added 2020/08/31 10:56 p.m.59 views

Content Injection in remarkable

Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link protocols, and consequently allowed javascript: to be used. Proof of Concept Markdown Source: link Rendered HTML: li...

6.1CVSS5.7AI score0.00973EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2020/08/28 8:48 p.m.59 views

Cross Site Scripting in baserCMS

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting XSS. Impact: XSS via Arbitrary script execution. Attack vector is: Administrator must be logged in. Components are: contentfields.php, contentinfo.php, contentoptions.php, contentrelated.php, indexlisttree.php, jquery.bcTree.js Tested...

7.3CVSS2.2AI score0.01011EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2020/08/19 7:52 p.m.59 views

Remote Code Execution in SyliusResourceBundle

Impact Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. The vulnerable versions...

9.6CVSS4.3AI score0.02149EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2020/07/07 12:01 a.m.59 views

Context isolation bypass via leaked cross-context objects in Electron

Impact Apps using contextIsolation are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds There are no app-side workarounds, you must update your...

9CVSS4.7AI score0.00367EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2019/08/06 1:43 a.m.59 views

Allocation of Resources Without Limits or Throttling in Apache Tika

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later...

8.8CVSS2.4AI score0.0484EPSS
SaveExploits0References10Affected Software1
Github Security Blog
Github Security Blog
added 2019/06/27 5:25 p.m.59 views

Cross-Site Scripting via JSONP

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors...

4.2AI score
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2019/06/07 8:56 p.m.59 views

Code Injection in PyXDG

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDGCONFIGDIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in...

7.5CVSS3.6AI score0.02105EPSS
SaveExploits1References7Affected Software1
Github Security Blog
Github Security Blog
added 2019/03/25 6:03 p.m.59 views

jackson-databind Deserialization of Untrusted Data vulnerability

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled either globally or for a specific property, the service has the Jodd-db jar for database access for the Jodd framework in the classpath, and an attacker can provide an LDAP...

7.5CVSS8.7AI score0.07348EPSS
SaveExploits0References40Affected Software1
Github Security Blog
Github Security Blog
added 2019/01/04 5:45 p.m.59 views

PyYAML insecurely deserializes YAML strings leading to arbitrary code execution

In PyYAML before 5.1, the yaml.load API could execute arbitrary code. In other words, yaml.safeload is not used. This was intended to be fixed in 4.1, but due to breaking changes, 4.1 was yanked and 5.1 contains the patch for CVE-2017-18342...

9.8CVSS7.1AI score0.05656EPSS
SaveExploits2References14Affected Software1
Github Security Blog
Github Security Blog
added 2018/07/13 3:16 p.m.59 views

Code injection in ansible

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability...

7.8CVSS5AI score0.02991EPSS
SaveExploits1References8Affected Software1
Github Security Blog
Github Security Blog
added 2017/10/24 6:33 p.m.59 views

actionpack vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the numbertocurrency helper in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter...

4.3CVSS5.5AI score0.03171EPSS
SaveExploits0References18Affected Software1
Github Security Blog
Github Security Blog
added 2017/10/24 6:33 p.m.59 views

ActiveRecord in Ruby on Rails allows database-query bypass

Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

7.5CVSS7.4AI score0.03903EPSS
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
added 2026/08/07 3:10 p.m.58 views

Smarty Security stream restriction bypass through stream: resource

smarty/smarty version 5.8.0 can read local files through PHP stream wrappers even when Smarty Security is enabled and all streams are disabled with Security::$streams = null. The bypass uses Smarty's built-in stream: resource type. A template such as: smarty include...

6.9CVSS5.5AI score0.00419EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/07/17 4:52 p.m.58 views

vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass for audio models

Issue Description Librosa defaults to using numpy.mean for mono downmixing tomono, while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in: - Inconsistency between audio heard by humans e.g., through headphones/regular speakers and...

7.1CVSS5.3AI score0.00267EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/15 5:35 p.m.58 views

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

Summary Nodemailer's disableFileAccess and disableUrlAccess options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME streaming path enforces those options in MimeNode.getStream. However, jsonTransport serializes messages by calling...

5.5AI score
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/05/19 2:35 p.m.58 views

Algernon: Single-file mode unconditionally enables debug mode

Summary When Algernon is invoked with a single file path instead of a directory — the documented "quick demo" workflow algernon foo.lua, algernon page.po2, algernon index.html, algernon mywebsite.alg — singleFileMode is set to true and debugMode is forcibly enabled with no opt-out: go //...

7.5CVSS5.8AI score0.00303EPSS
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/05/12 3:06 p.m.58 views

protobuf.js: Code injection in pbjs static output from crafted schema names

Summary pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without...

8.7CVSS5.9AI score0.00395EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/05/08 5:02 p.m.58 views

MCP Registry has open redirect via protocol-relative path in trailing-slash middleware

Summary The TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path e.g., //evil.com/ that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an...

5.8AI score0.0041EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2025/11/27 3:30 a.m.58 views

Ray's New Token Authentication is Disabled By Default

Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces including the dashboard and Jobs API is disabled unless explicitly enabled by setting RAYAUTHMODE=token. In the default unauthenticated state, a remote attacker with...

8.2AI score0.00474EPSS
SaveExploits5References10Affected Software1
Github Security Blog
Github Security Blog
added 2025/07/21 7:04 p.m.58 views

form-data uses unsafe random function in form-data for choosing boundary

Summary form-data uses Math.random to select a boundary value for multipart form-encoded data. This can lead to a security issue if an attacker: 1. can observe other values produced by Math.random in the target application, and 2. can control one field of a request made using form-data Because th...

9.4CVSS7.1AI score0.01769EPSS
SaveExploits1References6Affected Software1
Github Security Blog
Github Security Blog
added 2025/05/29 4:50 p.m.58 views

Fabio allows HTTP clients to manipulate custom headers it adds

Summary Fabio allows clients to remove X-Forwarded headers except X-Forwarded-For due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should...

9.1CVSS7.4AI score0.00487EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
added 2024/09/10 7:41 p.m.58 views

express vulnerable to XSS via response.redirect()

Impact In express 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect may execute untrusted code Patches this issue is patched in express 4.20.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issu...

5CVSS6.8AI score0.00486EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2024/09/03 7:45 p.m.58 views

Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability CVE-2024-45048. To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, pleas...

8.8CVSS6.8AI score0.00605EPSS
SaveExploits1References3Affected Software3
Github Security Blog
Github Security Blog
added 2024/08/20 6:31 p.m.58 views

Grafana plugin data sources vulnerable to access control bypass

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query...

5.4CVSS6.9AI score0.00305EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2024/08/09 9:23 p.m.58 views

OpenFGA Authorization Bypass

Overview OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses but not and from expressions and a userset. Fix - If you are using OpenFGA within Docker or as a Go library, as a binary, or through Docker, upgrade to v1.5.9 as soon as possibl...

9.8CVSS7.5AI score0.00527EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2024/08/02 9:12 p.m.58 views

Reposilite artifacts vulnerable to Stored Cross-site Scripting

Summary Reposilite v3.5.10 is affected by Stored Cross-Site Scripting XSS when displaying artifact's content in the browser. Details As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The...

7.1CVSS6.8AI score0.00828EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2024/07/05 8:03 p.m.58 views

ZITADEL Vulnerable to Session Information Leakage

Impact ZITADEL provides users the ability to list all user sessions of the current user agent browser by API and in the Console UI. Due to a missing check, user sessions without that information e.g. when created though the session service were incorrectly listed exposing potentially other user's...

6.5CVSS6.5AI score0.00609EPSS
SaveExploits0References12Affected Software1
Github Security Blog
Github Security Blog
added 2024/06/10 9:38 p.m.58 views

@grpc/grpc-js can allocate memory for incoming messages well above configured limits

Impact There are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded. 2. If an...

5.3CVSS7.2AI score0.00671EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2024/06/04 12:31 p.m.58 views

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

8.8CVSS8.8AI score0.00618EPSS
SaveExploits1References3Affected Software1
Github Security Blog
Github Security Blog
added 2024/05/15 10:03 p.m.58 views

Read private customer data reclaiming carts in Klaviyo Magento

A researcher identified an endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API...

6.9AI score
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2024/04/25 7:50 p.m.58 views

vyper performs multiple eval of `sqrt()` argument built in

Summary Using the sqrt builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult but not impossible! to trigger as of 0.3.4, when the unique symbol fence was introduced https://github.com/vyperlang/vyper/pull/2914. A contract sear...

5.3CVSS5.4AI score0.00455EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2024/04/17 6:21 p.m.58 views

.NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2024-21409 | .NET Elevation of Privilege Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 7.0 ,and .NET 8.0. This advisory also provides guidance on what developers can do t...

7.3CVSS7.3AI score0.02513EPSS
SaveExploits0References5Affected Software3
Github Security Blog
Github Security Blog
added 2024/03/22 3:31 p.m.58 views

Cross-site Scripting in Moodle Chat

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

5.4CVSS6.5AI score0.00551EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2024/03/12 6:31 p.m.58 views

Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server

Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability...

8.8CVSS8.5AI score0.02106EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2024/02/29 3:33 a.m.58 views

json-jwt allows bypass of identity checks via a sign/encryption confusion attack

The json-jwt aka JSON::JWT gem 1.16.x before 1.16.6, 1.15.x before 1.15.3.1 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...

8.4CVSS6.3AI score0.00233EPSS
SaveExploits1References8Affected Software1
Github Security Blog
Github Security Blog
added 2024/02/02 8:43 p.m.58 views

PHPMailer Local file inclusion

Impact Arbitrary local file inclusion via the $lang property, remotely exploitable if host application passes unfiltered user data into that property. The 3 CVEs listed are applications that used PHPMailer that were vulnerable to this problem. Patches It's not known exactly when this was fixed in...

7.5CVSS6.3AI score0.01435EPSS
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2024/01/22 3:30 a.m.58 views

SQL injection in llama-index

LlamaIndex aka llamaindex through 0.9.35 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

9.8CVSS7.8AI score0.0066EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
added 2024/01/11 4:30 p.m.58 views

Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

Summary The Home Preference page exposes a small list of nginx settings such as Nginx Access Log Path and Nginx Error Log Path. However, the API also exposes testconfigcmd, reloadcmd and restartcmd. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sendi...

8.8CVSS7.1AI score0.01537EPSS
SaveExploits1References8Affected Software1
Github Security Blog
Github Security Blog
added 2023/12/05 3:30 p.m.59 views

Cross-Site Request Forgery in JFinalCMS via /admin/friend_link/update

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/friendlink/update...

8.8CVSS7.5AI score0.00391EPSS
SaveExploits1References3Affected Software1
Total number of security vulnerabilities5000