Lucene search
+L
GithubMost viewed

35598 matches found

Github Security Blog
Github Security Blog
•added 2023/11/20 9:00 p.m.•58 views

Cookies are sent to external images in rendered diff (and server side request forgery)

Impact The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These requests are also sent for images from other domains and include all cookies that...

9CVSS6.7AI score0.0071EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
•added 2023/11/14 6:27 p.m.•58 views

Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.9.2post0 and was tested on version 1.8.2. Overview In all current versions of Label Studio, the application allow...

7.5CVSS7AI score0.04055EPSS
SaveExploits3References5Affected Software1
Github Security Blog
Github Security Blog
•added 2023/11/08 2:51 p.m.•58 views

XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu

Impact XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name ...

9.6CVSS7.3AI score0.02191EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
•added 2023/10/25 9:30 p.m.•58 views

Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the...

8.8CVSS8AI score0.56605EPSS
SaveExploits2References6Affected Software1
Github Security Blog
Github Security Blog
•added 2023/10/10 6:31 p.m.•58 views

Apache Tomcat Incomplete Cleanup vulnerability

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened ...

5.9CVSS6.7AI score0.01854EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
•added 2023/09/24 3:30 a.m.•58 views

kube-apiserver authentication bypass vulnerability

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch...

8CVSS7AI score0.01569EPSS
SaveExploits0References11Affected Software1
Github Security Blog
Github Security Blog
•added 2023/09/20 12:30 p.m.•58 views

Quarkus HTTP vulnerable to incorrect evaluation of permissions

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized...

8.1CVSS6.6AI score0.01437EPSS
SaveExploits1References17Affected Software4
Github Security Blog
Github Security Blog
•added 2023/09/12 1:52 p.m.•58 views

OpenRefine Remote Code execution in project import with mysql jdbc url attack

Summary An remote Code exec vulnerability allows any unauthenticated user to exec code on the server. Details Hi,Team, i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can ge...

9.8CVSS7.3AI score0.4254EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
•added 2023/09/06 3:30 p.m.•58 views

Apache Superset Deserialization of Untrusted Data vulnerability

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by t...

6.6CVSS7.1AI score0.35455EPSS
SaveExploits2References4Affected Software1
Github Security Blog
Github Security Blog
•added 2023/09/01 8:51 p.m.•58 views

tss-lib leaks secret keys in response to incorrectly constructed Paillier moduli

Impact The specification of the GG18 threshold ECDSA signature protocol contains a vulnerability allowing an attacker to recover the shared secret key. If a participant generates a Paillier modulus N containing small factors less than 2^100 they can interact with other participants in the signing...

6.7AI score
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
•added 2023/08/31 12:30 a.m.•58 views

Path traversal in Zip Swift

An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry...

7.8CVSS7AI score0.00447EPSS
SaveExploits1References6Affected Software1
Github Security Blog
Github Security Blog
•added 2023/08/09 1:04 p.m.•58 views

.NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2023-38178: .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0. This advisory also provides guidance on what developers can do to update their applications to...

7.5CVSS6.7AI score0.0259EPSS
SaveExploits0References4Affected Software8
Github Security Blog
Github Security Blog
•added 2023/07/11 10:46 p.m.•58 views

Decidim Cross-site Scripting vulnerability in the processes filter

Impact The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of...

8.1CVSS6.3AI score0.00736EPSS
SaveExploits0References8Affected Software2
Github Security Blog
Github Security Blog
•added 2023/06/14 5:04 p.m.•58 views

.NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2023-24936: .NET Elevation of Privilege Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update the...

7.5CVSS6.7AI score0.01558EPSS
SaveExploits0References5Affected Software12
Github Security Blog
Github Security Blog
•added 2023/04/24 10:34 p.m.•58 views

Rancher Webhook is misconfigured during upgrade process

Impact A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks before resources are admitted into the Kubernetes cluster. When the Webhook is operating in a degraded state, it no...

9.9CVSS8.9AI score0.00779EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
•added 2023/04/19 6:15 p.m.•58 views

OutOfMemoryError for large multipart without filename in Eclipse Jetty

Impact Servlets with multipart support e.g. annotated with @MultipartConfig that call HttpServletRequest.getParameter or HttpServletRequest.getParts may cause OutOfMemoryError when the client sends a multipart request with a part that has a name but no filename and a very large content. This...

5.3CVSS5.9AI score0.0326EPSS
SaveExploits0References11Affected Software1
Github Security Blog
Github Security Blog
•added 2023/04/18 1:14 p.m.•58 views

Shopware Has Improper Control of Generation of Code in Twig rendered views

Impact We fixed with CVE-2023-22731 Twig filters to only be executed with allowed functions. It is possible to pass PHP Closures as string or an array and array crafted PHP Closures was not checked against allow list Patches The problem has been fixed with 6.4.20.1 with an improved override...

9.9CVSS8.4AI score0.02066EPSS
SaveExploits1References7Affected Software2
Github Security Blog
Github Security Blog
•added 2023/04/02 9:30 p.m.•58 views

Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control coverage report file contents for the Post to Phabricator post-build action to have Jenkins parse a crafted XML document th...

8.2CVSS7.9AI score0.00569EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
•added 2023/04/02 3:30 a.m.•58 views

RuoYi vulnerable to arbitrary file download

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server...

7.5CVSS7.4AI score0.00337EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
•added 2023/03/23 9:30 p.m.•58 views

Spring Vault vulnerable to insertion of sensitive information into a log file

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token...

5.5CVSS5.3AI score0.00223EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
•added 2023/02/08 10:28 p.m.•58 views

openssl-src vulnerable to Use-after-free following `BIO_new_NDEF`

The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the...

7.5CVSS7.8AI score0.04494EPSS
SaveExploits0References12Affected Software1
Github Security Blog
Github Security Blog
•added 2023/02/06 6:30 p.m.•58 views

Exposure of Sensitive Information in EVE-SRP

A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may ...

4.3CVSS4.9AI score0.00672EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
•added 2023/02/05 9:30 p.m.•58 views

Cross-site Scripting in DaSchTour matomo-mediawiki-extension

A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely...

6.1CVSS6AI score0.00614EPSS
SaveExploits1References7Affected Software1
Github Security Blog
Github Security Blog
•added 2022/12/13 5:11 p.m.•58 views

TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework

Problem Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it was possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular...

8.8CVSS3.1AI score0.00785EPSS
SaveExploits0References7Affected Software2
Github Security Blog
Github Security Blog
•added 2022/12/07 11:23 p.m.•58 views

containerd CRI stream server vulnerable to host memory exhaustion via terminal

Impact A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the gorouti...

6.5CVSS2.1AI score0.01022EPSS
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
•added 2022/11/22 12:30 p.m.•58 views

OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...

9.8CVSS9.1AI score0.0336EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
•added 2022/11/21 10:36 p.m.•58 views

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui

Impact Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The URL...

9.9CVSS8.9AI score0.01224EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
•added 2022/11/02 6:10 p.m.•58 views

Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp

Impact The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service DoS when supplied with a maliciously crafted PDF file to be appended to another. Patches It has been patched in 2.6.0 for muhammara and not at all for hummus Workarounds Do not process...

7.5CVSS6.2AI score0.0077EPSS
SaveExploits1References7Affected Software2
Github Security Blog
Github Security Blog
•added 2022/10/29 12:29 a.m.•58 views

RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

Impact The user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template Injection RCE. Patches Update to version 10.5.9 or apply this patch manually https://github.com/pimcore/pimcore/pull/13347.patch Workarounds Apply...

9.8CVSS9.3AI score0.01788EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
•added 2022/09/16 10:28 p.m.•58 views

TensorFlow vulnerable to `CHECK` fail in `MaxPool`

Impact When MaxPool receives a window size input array ksize with dimensions greater than its input tensor input, the GPU kernel gives a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf import numpy as np input = np.ones1, 1, 1, 1 ksize = 1, 1, 2, ...

7.5CVSS7.3AI score0.00478EPSS
SaveExploits0References5Affected Software3
Github Security Blog
Github Security Blog
•added 2022/07/28 12:00 a.m.•58 views

Jenkins HashiCorp Vault Plugin does not perform permission checks in several HTTP endpoints that perform Vault connection tests

A missing permission check in Jenkins HashiCorp Vault Plugin 354.vdb858fd6bf48 and earlier allows attackers with Overall/Read permission to obtain credentials stored in Vault with attacker-specified path and keys...

6.5CVSS6.4AI score0.00688EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/25 10:41 p.m.•58 views

Cross-site Scripting in wiki manager join wiki page

Impact We found a possible XSS vector in the WikiManager.JoinWiki wiki page related to the "requestJoin" field. Patches The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. Workarounds The easiest workaround is to edit the wiki page WikiManager.JoinWiki with wiki editor and chan...

7.4CVSS5.7AI score0.00969EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/24 7:18 p.m.•58 views

Incorrect Authorization in MySQL Connector Java

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful...

7.9CVSS4.1AI score0.07493EPSS
SaveExploits1References4Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/24 7:14 p.m.•58 views

Missing Authentication for Critical Function in Apache Airflow

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

9.8CVSS9.4AI score0.80938EPSS
SaveExploits2References6Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/24 5:48 p.m.•58 views

Remote code execution vulnerability in Jenkins Templating Engine Plugin

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin. This vulnerability allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. Jenkins Templating Engine Plugin 2....

8.8CVSS8.7AI score0.01749EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/24 5:39 p.m.•58 views

Gravity Forms stored Cross-Site Scripting (XSS) vulnerability

A stored Cross-Site Scripting XSS vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via the import of a GF form. This code is interpreted by users in a privileged role Administrator, Editor, etc...

4.8CVSS5.6AI score0.00796EPSS
SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/23 9:13 p.m.•58 views

Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server

Impact All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server. A malicious Argo CD user with write access for a repository which is or may be used in...

4.3CVSS1.2AI score0.01106EPSS
SaveExploits0References9Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/19 12:00 a.m.•58 views

SQL injection in moodle

A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria...

9.8CVSS9.7AI score0.01393EPSS
SaveExploits0References9Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/14 3:44 a.m.•58 views

Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

7.5CVSS8AI score0.02366EPSS
SaveExploits0References11Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/14 3:08 a.m.•58 views

CodeIgniter Session Fixation Vulnerability

A Session Fixation issue exists in CodeIgniter before 3.1.10 because session.usestrictmode in the Session Library was mishandled...

9.8CVSS9.5AI score0.01504EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/14 2:37 a.m.•58 views

JBoss RESTEasy vulnerable to Improper Input Validation

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions...

8.1CVSS7.4AI score0.05922EPSS
SaveExploits0References18Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/14 1:57 a.m.•58 views

Arbitrary code execution in Apache Struts 2

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "$" and "%" sequences, which causes the OGNL code to be evaluated twice...

9.3CVSS8AI score0.13828EPSS
SaveExploits0References17Affected Software2
Github Security Blog
Github Security Blog
•added 2022/05/13 1:15 a.m.•58 views

Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts...

9.8CVSS5.1AI score0.03366EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/13 1:14 a.m.•58 views

Code injection in Apache Struts

The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within...

9.8CVSS2AI score0.99998EPSS
SaveExploits18References17Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/13 1:02 a.m.•58 views

Cross-Site Request Forgery in Spring Framework

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML Extern...

6.8CVSS6.5AI score0.91354EPSS
SaveExploits0References9Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/05 12:29 a.m.•58 views

Features file injection vulnerability

File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory...

5.4CVSS3.9AI score0.0081EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
•added 2022/05/01 6:32 p.m.•58 views

Exposure of Sensitive Information in Apache Tomcat

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

5CVSS2.6AI score0.62575EPSS
SaveExploits2References64Affected Software1
Github Security Blog
Github Security Blog
•added 2022/04/23 12:40 a.m.•58 views

Hash collision attack vulnerability in Jenkins

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before 1.424.2.1 and 1.400.x before 1.400.0.11 could allow remote attackers to cause a considerable CPU load, aka "the Hash DoS attack."...

7.8CVSS6.8AI score0.03351EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
•added 2022/04/23 12:03 a.m.•58 views

Disputed: OS Command injection in github.com/kardianos/service

servicewindows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory. The validity of this vulnerability has been questioned and the reporter has requested that the CVE be disputed...

7.8CVSS7.4AI score0.00326EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
•added 2022/04/22 12:24 a.m.•58 views

Openstack nova qcow format could expose host filesystem information

Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem...

8.6CVSS7AI score0.0074EPSS
SaveExploits0References5Affected Software1
Total number of security vulnerabilities5000