27267 matches found
GHSA-C962-G533-823F Cross-site Scripting in Bagisto
Cross Site Scripting vulnerability in webkil Bagisto v1.3.1 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad...
GHSA-JQPC-RC7G-VF83 User accounts disclosed to unauthenticated actors on the LAN
Summary The login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Details Starting the Home Assistant 2023.12 release, the login page returns all currently active user accounts to browsing requests from the Local Area Network...
GHSA-4GFC-72GW-V385 Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability
Jenkins Nexus Platform Plugin 3.18.0-03 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML. Additionally, the plugin does not...
GHSA-FW9X-CQJQ-7JX5 baserCMS CSRF vulnerability in Content preview Feature
There is a CSRF Vulnerability in Content preview Feature to baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible. Target baserCMS 4.7.8 and earli...
GHSA-VW64-G7C6-MM7G Jenkins lambdatest-automation Plugin missing permission check
Jenkins lambdatest-automation Plugin 1.20.9 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins. Those can be used as part of an attack to capture the...
GHSA-MR4W-7VM9-CGQX Zenario CMS Cross-site Scripting vulnerability
A Cross-Site Scripting XSS vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias...
GHSA-J8RM-CM55-QQJ6 .NET Information Disclosure Vulnerability
Microsoft Security Advisory CVE-2023-35391: .NET Information Disclosure Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET core 2.1, .NET 6.0 and, .NET 7.0. This advisory also provides guidance on what developers c...
GHSA-VH2G-6C4X-5HMP Path traversal and code execution via prototype vulnerability
Impact Due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. Patches Patched in v2.8.7...
GHSA-Q57W-826P-46JR Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability
Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use getsqlalchemyconnection and someone with access to connection resources...
GHSA-GH24-9QJJ-MR67 Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2023-33126: .NET Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update thei...
GHSA-75R3-38RH-PMXV sojo vulnerable to stack exhaustion
An issue was discovered sojo through 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies...
GHSA-5H3X-9WVQ-W4M2 OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning
Impact By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the Governor contract in v4.9.0 only, and the...
GHSA-7GF7-JV65-WJMH xml-rs vulnerable to denial of service via invalid token in XML document
The xml-rs crate = 0.8.9 and 0.8.14 for Rust and Crab allows a denial of service panic via an invalid ! token such as !DOCTYPEs/%!A nesting in an XML document...
GHSA-QJ8W-RV5X-2V9H Duplicate Advisory: Starlette vulnerable to directory traversal
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v5gw-mw7f-84px. This link is maintained to preserve external references. Original Description Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote...
GHSA-WV7J-RC2Q-9J67 Cross Site Scripting in CraftCMS
CraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting XSS. An attacker can inject javascript code into Volume Name...
GHSA-W6Q2-48CH-FJ26 Allegro Tech BigFlow vulnerable to Missing SSL Certificate Validation
Allegro Tech BigFlow prior to 1.6.0 is vulnerable to Missing SSL Certificate Validation...
GHSA-HHJM-MPMF-CXG9 Microweber vulnerable to stored cross-site scripting (XSS) via X-Forwarded-For header
microweber/microweber prior to 1.3.3 is vulnerable to stored cross-site scripting XSS via the X-Forwarded-For header. This was fixed in version 1.3.3...
GHSA-FWHV-9PHJ-WRJ5 Uvdesk vulnerable to stored cross-site scripting (XSS)
Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket...
GHSA-48G9-H7G5-8PW2 Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgery
Convert To Pipeline Plugin 1.0 and earlier does not require POST requests for the HTTP endpoint converting a Freestyle project to Pipeline, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to create a Pipeline based on a Freestyle project. Combined...
GHSA-42C3-WVWW-GCQJ Pimcore Remote Code Execution vulnerability in Search function
Impact Attacker can get full DB and maybe RCE knowing the WEBROOT path Patches Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2.patch Workarounds Apply patch...
GHSA-47PJ-Q2VM-46XC Collection.js vulnerable to Prototype Pollution
Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js...
GHSA-9V4V-9FJ5-P982 Answer vulnerable to Cross-site Scripting
Cross-site Scripting XSS - Stored in GitHub repository answerdev/answer prior to 1.0.6...
GHSA-QXPM-5GHC-6GC2 jeecg-boot contains SQL Injection vulnerability
jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component...
GHSA-HF4X-6H87-HM79 MantisBT may expose private issues' summaries to unauthorized users
Impact Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary field of private Issues i.e. having Private view status, or belonging to a private Project via a crafted bugarr parameter in bugactiongroupext.php. Patches The...
GHSA-VM5R-C87R-PF6X Parse Server option `masterKeyIps` vulnerability to IP spoofing
Impact Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various feature...
GHSA-Q3RM-F527-GHXJ Publify Improper Input Validation vulnerability
Improper Input Validation in GitHub repository publify/publify prior to 9.2.10...
GHSA-QRRF-XVCF-P64Q usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts
In usememos/memos 0.9.0 and prior, an attacker can delete other users' posts via post id, which can be done via brute force...
GHSA-5RHG-XHGR-5HFJ go-saml's XML Digital Signatures use SHA-1
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...
GHSA-M3CQ-XCX9-3GVM kyverno verifyImages rule bypass possible with malicious proxy/registry
Impact Users of Kyverno on versions 1.8.3 or 1.8.4 who use verifyImages rules to verify container image signatures, and do not prevent use of unknown registries. Patches This issue has been fixed in version 1.8.5 Workarounds Configure a Kyverno policy to restrict registries to a set of secure...
GHSA-RMF2-PWFQ-H75J OS Command Injection in Apache Airflow
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider...
GHSA-4WPH-9VRM-6V3W Rdiffweb vulnerable to Missing Authentication for Critical Function
Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6...
GHSA-682J-2P53-XP5F Agent-to-controller security bypass vulnerability in Jenkins BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin
BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed. It allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controll...
GHSA-MXRX-FG8P-5P5J Bifrost vulnerable to authentication check flaw that leads to authentication bypass
Impact The admin and monitor user groups need to be authenticated by username and password. If we delete the X-Requested-With: XMLHttpRequest field in the request header,the authentication will be bypassed. Patches https://github.com/brockercap/Bifrost/pull/201 Workarounds Upgrade to the latest...
GHSA-V57H-6HMH-G2P4 Weight not properly refunded after EVM execution
Impact Previously, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as...
GHSA-9MC6-VGMQ-X6XF Lack of authentication mechanism in Jenkins DotCi Plugin webhook
DotCi Plugin provides a webhook endpoint at /githook/ that can be used to trigger builds of the job for a GitHub repository. In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to...
GHSA-4R4F-JRVW-H727 Feehi CMS host header injection vulnerability
A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails...
GHSA-J6X3-3JQQ-M922 CrafterCMS OS Command Injection vulnerability
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass...
GHSA-HC94-9V26-GXWV Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter
Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF Server-Side Request Forgery attacks via a crafted requesturi parameter...
GHSA-772J-XVF9-QPF5 ansible-runner vulnerable to Race Condition
A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's privatedatadir the next time ansible-runner made use of the privatedatadir...
GHSA-4696-G7JJ-XG2H Mapbox is vulnerable to Integer Overflow
An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new Image and allows for out of bounds...
GHSA-HCCX-CG4V-HRJX JetBrain Ktor before 2.1.0 vulnerable to selection of wrong authentication provider
In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases...
GHSA-JP45-65JW-94MJ heroku-env susceptible to command injection
A command injection vulnerability affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
GHSA-HM53-HRHH-GWFQ Missing permission checks in Jenkins openstack-heat Plugin
openstack-heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL...
GHSA-HCJR-6JQ3-392P Jenkins Failed Job Deactivator Plugin Missing Authorization vulnerability
Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints. This allows attackers with Overall/Read permission to disable jobs. Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery...
GHSA-73PR-G6JJ-5HC9 Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql
A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. In these cases, the server has the option to create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide addition...
GHSA-374W-GWQR-FMXG brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS
The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...
GHSA-FQ4H-M3C8-8M2V Improper Privilege Management in NocoDB
Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.8...
GHSA-FW45-938V-P26J mootools-more vulnerable to prototype pollution
Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype...
GHSA-Q9WJ-F4QW-6VFJ Read buffer overruns processing ASN.1 strings
ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL 0 byte...
GHSA-J66Q-QMRC-89RX jsonpickle unsafe deserialization
jsonpickle through 1.4.2 allows remote code execution during deserialization of a malicious payload through the decode function. This CVE is disputed by the project author as intended functionality...