15518 matches found
GHSA-C2HM-MJXV-89R4 Multiple soundness issues in lexical
lexical contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls MaybeUninit::assumeinit ...
GHSA-4HG4-9MF5-WXXQ incorrect order of evaluation of side effects for some builtins
Impact The order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. • For uint256addmoda,b,c and uint256mulmoda,b,c, the order is c,a,b. • For ecadda,b and ecmula,b, the order is b,a. Note that this behaviour is...
GHSA-G2XH-C426-V8MF Vyper: reversed order of side effects for some operations
Impact For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. - unsafeadd - unsafesub - unsafemul - unsafediv - powmod256 - |, &, ^ bitwise operators - bitwiseor deprecated - bitwiseand deprecated - bitwisex...
GHSA-8RV7-G772-PP3J DataEase vulnerable to SQL injection
SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function...
GHSA-R285-Q736-9V95 Filename spoofing in archive
An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing...
GHSA-9V85-Q87Q-G4VG Path traversal in Archive
An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file...
GHSA-G454-WJ9R-JPG4 Path traversal in Zip Swift
An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry...
GHSA-J5G3-5C8R-7QFX Prevent logging invalid header values
Impact What kind of vulnerability is it? Apollo Server can log sensitive information Studio API keys if they are passed incorrectly with leading/trailing whitespace or if they have any characters that are invalid as part of a header value. Who is impacted? Users who all of the below: use either t...
GHSA-VMF9-6PCV-XR87 Withdrawn Advisory: Username enumeration attack in goauthentik
Withdrawn Advisory This advisory has been withdrawn due to an incorrect package mapping error. This link is maintained to preserve external references. Original Description Summary Using a recovery flow with an identification stage an attacker is able to determine if a username exists. Impact Onl...
GHSA-R726-VMFQ-J9J3 Open Redirect Vulnerability in jupyter-server
Impact Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. Patches Upgrade to Jupyter Server 2.7.2 Workaround...
GHSA-WFM5-V35H-VWF4 GitPython untrusted search path on Windows systems leading to arbitrary code execution
Summary When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment see big warning in https://docs.python.org/3/library/subprocess.htmlpopen-constructor. GitPython defaults to use the git command, if a user runs GitPython from a repo has a...
GHSA-V638-Q856-GRG8 MathJax Regular expression Denial of Service (ReDoS)
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service ReDoS vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk...
GHSA-VXVM-QWW3-2FH7 MongoDB Driver may publish events containing authentication-related data
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may...
GHSA-MHP6-JVPX-2P4M Heap-based buffer overflow in ZBar
A heap-based buffer overflow exists in the qrreadermatchcenters function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be...
GHSA-CH3C-V47X-4PGP Cleartext Signed Message Signature Spoofing in openpgp
Impact OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This text is signed. -----BEGIN PGP SIGNATURE----- wnUEARMIACcFgmTkrNAJkInXCgj0fgcIFiEE1JlKzzDGQxZmmHkYidcKCPR+...
GHSA-3R28-RGP9-QGV4 pf4j vulnerable to remote code execution via the zippluginPath parameter
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter...
GHSA-CJ8W-V588-P8WX pf4j vulnerable to remote code execution via expandIfZip method in the extract function
An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function...
GHSA-3R32-CP7V-5WQ4 Code injection in ansible semaphore
An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter...
GHSA-99FG-2H75-M92H Spipu HTML2PDF vulnerable to cross-site scripting
Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php...
GHSA-G3M9-PR5M-4CVP Airflow Sqoop Provider RCE Vulnerability
Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged...
GHSA-VJ49-J7RC-H54F Esoteric YamlBeans XML Entity Expansion vulnerability
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size,...
GHSA-JM7R-4PG6-GF26 Esoteric YamlBeans Unsafe Deserialization vulnerability
An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed...
GHSA-JCF2-MXR2-GMQP OpenFGA Authorization Bypass
Overview Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. This means that the API sometimes returns more objects than it should. Am I Affected? The vulnerability affects customers using ListObjects with specific models. The...
GHSA-826J-8WP2-4X6Q Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User
Impact A Mass assignment vulnerability was found allowing a non-admin user to escalate privileges to admin user. Patches Issue is patched in 0.17.1, and fixed in 0.18.6+. If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch...
GHSA-256M-J5QW-38F4 Netmaker IDOR Allows User to Update Other User's Password
Impact An IDOR vulnerability was found in the user update function. By specifying another user's username it is possible to update the other user's password. Patches Issue is patched in 0.17.1, and fixed in 0.18.6+. If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1"...
GHSA-8X8H-HCQ8-JWWX Netmaker has Hardcoded DNS Secret Key
Impact Hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. Patches Issue is patched in 0.17.1, and fixed in 0.18.6+. If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will...
GHSA-8QV2-5VQ6-G2G7 webpki: CPU denial of service in certificate path building
When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building. Both TLS clients and TLS servers that accept client certificate are affected. This was previously reported in...
GHSA-37XQ-Q42P-RV3P ntpd has Dependency on Vulnerable Third-Party Component
During startup, an attacker that can man-in-the-middle traffic to and from NTS key exchange servers can trigger a very expensive key validation process due to a vulnerability in webpki. Impact This vulnerability can lead to excessive cpu usage on startup on clients configured to use NTS Patches...
GHSA-WRRJ-H57R-VX9P Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports
The Rust Security Response WG was notified that Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to XSS if the report is subsequent...
GHSA-Q4PP-J36H-3GQG Minimal `basti` IAM Policy Allows Shell Access
Summary The provided Minimal IAM Policy for bastic connect does not include ssm:SessionDocumentAccessCheck. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding. Details basti connect is designed to "securely connect to your...
GHSA-CR5Q-6Q9F-RQ6Q Active Support Possibly Discloses Locally Encrypted Files
There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...
GHSA-8RJ5-2857-877J json2xml Uncaught Exception vulnerability
The json2xml package for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service...
GHSA-93WX-J2QV-49FG hCaptcha for EXT:form Broken Access Control vulnerability
An issue was discovered in the hcaptcha aka hCaptcha for EXT:form extension before 2.1.2 for TYPO3. It fails to check that the required captcha field is submitted in the form data. allowing a remote user to bypass the CAPTCHA check...
GHSA-CRV8-R5WQ-GV2W webui-aria2 Path Traversal vulnerability
webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability...
GHSA-7CH3-7PP7-7CPQ Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users
Impact This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The /-/api API explorer endpoint could reveal the names of both databases an...
GHSA-FH2R-99Q2-6MMG rustls-webpki: CPU denial of service in certificate path building
When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building. Both TLS clients and TLS servers that accept client certificate are affected. We now give each path building operation...
GHSA-4XMF-344Q-M4CC Jenkins Fortify Plugin missing permission check
Jenkins Fortify Plugin 22.1.38 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials store...
GHSA-599V-H3Q5-G6R9 Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.6.8 or apply this patch manually...
GHSA-P8GP-899C-JVQ9 Wallabag user can reset data unintentionally
Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived. This vulnerability has a CVSSv3.1 score of 4.3. You...
GHSA-H8CM-3V5F-RGP6 XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer
Impact Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down no free text value it can still be set from JavaScript using the browser developer tools or b...
GHSA-44WR-RMWQ-3PHW Craft CMS vulnerable to Remote Code Execution via validatePath bypass
Summary Bypassing the validatePath function can lead to potential Remote Code Execution Post-authentication, ALLOWADMINCHANGES=true Details In bootstrap.php, the SystemPaths path is set as below. php // Set the vendor path. By default assume that it's 4 levels up from here $vendorPath =...
GHSA-V6C8-PWHQ-288M Nacos Spring vulnerable to Unsafe Deserialization
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor component...
GHSA-CH6W-MC6C-G65G Duplicate Advisory: weaviate denial of service vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8697-479h-5mfp. This link is maintained to preserve external references. Original Description An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the...
GHSA-RWPG-4C4C-V3R4 Duplicate Advisory: Wallabag user can reset data unintentionally
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p8gp-899c-jvq9. This link is maintained to preserve external references. Original Description Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.6.3...
GHSA-2JC4-R94C-RP7H Apache Ivy External Entity Reference vulnerability
Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...
GHSA-G3MV-64H3-H482 Cockpit Cross-site Scripting vulnerability
Cross-site Scripting XSS - Reflected in GitHub repository cockpit-hq/cockpit version 2.6.3 and prior. A patch is available at commit 30609466c817e39f9de1871559603e93cd4d0d0c and anticipated to be part of version 2.6.4...
GHSA-7954-6M9Q-GPVF XWiki Platform privilege escalation (PR)/RCE from account through Invitation subject/message
Impact Any user who can view Invitation.WebHome can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This can be reproduced with the following steps: 1. Open the invitation...
GHSA-4GCF-5M39-98MC Woodpecker does not validate webhook before changing any data
Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. Patches Please use either nex...
GHSA-PV2G-VM98-VJXF Jenkins Config File Provider Plugin improper credential masking vulnerability
Jenkins Config File Provider Plugin 952.va544a6234b46 and earlier does not mask i.e., replace with asterisks credentials specified in configuration files when they’re written to the build log. Config File Provider Plugin 953.v0432a802e4d2 masks credentials configured in configuration files if the...
GHSA-3FQW-J7X8-G75J Jenkins Delphix Plugin missing permission check
Jenkins Delphix Plugin 3.0.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...