36904 matches found
GHSA-FQ3W-P4FG-MW73 fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`
Impact Affects: Anyone who generates the UNIX man pages in Fuji = 0.8.0 build with the dev crate feature. Consequences: /usr/share/man/man8 may be entirely removed & re-created without any of the previous entries. Patches At the time of writing, no new version has been released on crates.io, due ...
GHSA-WRR4-782V-JHWH neotoma has tenant isolation gap in relationship query endpoints
Summary The /listrelationships and /retrievegraphneighborhood endpoints call getAuthenticatedUserId confirming a valid session exists but do not pass the resolved user ID into the Supabase query as an .eq"userid", userId filter. As a result, queries return rows from all users rather than scoping ...
GHSA-JF6W-2MVX-633J justhtml: to_markdown() code-span blank-line breakout enables XSS
justhtml: tomarkdown code-span blank-line breakout enables XSS Summary In justhtml 0.9.0 through 1.21.0, tomarkdown renders text and text inside a link as an inline Markdown code span whose only protection is backtick-fence length. A blank line \n\n in that text terminates the inline span in any...
GHSA-2933-Q333-QG83 i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
Impact i18next-fs-backend ≤ 2.6.5, when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input, is vulnerable to prototype pollution via crafted missing-key strings. Backend.writeFile splits each queued missing-key string on the...
GHSA-F49M-VF83-692W i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
Impact i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not reject dotted variants such as "proto.polluted". Downstream backends that split the missing-key string on a...
GHSA-386J-6M86-78F9 OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing
Summary Description An Improper Verification of Cryptographic Signature CWE-347 issue in OpenAM's RADIUS authentication module allows an unauthenticated network attacker to spoof an Access-Accept response and obtain an OpenAM session for any RADIUS username, without knowing the configured shared...
GHSA-CJ8F-2FHF-826R OpenAM Arbitrary OAuth Token Minting via Push Registration
Summary Description An Authorization Bypass Through User-Controlled Key CWE-639 exists in OpenAM's stateful OAuth2 token-read path. Under certain conditions, this may allow an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary subject, client, realm, and scope. This affects...
GHSA-4VP2-6Q8C-PVQ2 @anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write
The Claude Code /copy command wrote responses to a hardcoded, predictable path /tmp/claude/response.md without UID isolation, randomness, or symlink protection. The file was created world-readable 0644 in a world-traversable directory 0755, allowing any local user to read a privileged user's Clau...
GHSA-PP89-732F-3G8Q OpenAM has Unsafe Java Deserialization via SNS
Summary Description A Deserialization of Untrusted Data CWE-502 issue exists in OpenAM's Push Notification SNS callback resource. The REST route that handles SNS push messages is mounted with anonymous access and, when a supplied message identifier has expired from the in-memory dispatcher, falls...
GHSA-4595-7FJW-R3JH Tiptap contains an input validation vulnerability resulting in DoS
Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set to an array instead of a string, causing an unhandled TypeError in the Link::isAllowedUri functio...
GHSA-7X27-G8RG-X87W Angular's deprecated package has a Cross-Site Scripting issue
A flaw in AngularJS' Strict Contextual Escaping SCE logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain...
GHSA-PRJ9-97MP-MWH2 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering
Description The filterToDefinedArgumentsOnly function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, a special case allows any argument whose name starts with ot to bypass this filter. While two system arguments...
GHSA-F637-W7P2-M7FX OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration
Summary The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled the...
GHSA-7FQ5-7WR8-RJWJ OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination
Summary OliveTin's template engine uses a single shared text/template.Template instance tpl package-level variable in service/internal/tpl/templates.go across all goroutines. Every action execution calls tpl.Parsesource followed by t.Execute on this shared instance with no synchronization. When t...
GHSA-P462-XXWX-PQF4 OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
Summary Description An Improper Authorization CWE-285 issue in OpenAM's Liberty Web Services SOAP receiver allows an unauthenticated remote attacker to write persistent entries into the Liberty Discovery store on any user's LDAP entry, and into a shared root-realm Discovery branch. This impacts...
GHSA-6C99-87FR-6Q7R OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
Summary Description A deserialization of untrusted data vulnerability CWE-502 exists in OpenAM's WebAuthn authentication module. Under certain conditions, this may allow an attacker to achieve arbitrary code execution in the context of the application server. This affects OpenAM Community Edition...
GHSA-6QC4-57V3-28RR Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specifi...
GHSA-X939-7FQ5-V9V6 Payara Server Full has a Cross-Site Request Forgery vulnerability
A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfresttoken to an attacker-controlled host that can result in a full unauthenticated takeover of Payara admin domain. A...
GHSA-8263-QV4G-VFXR Jenkins Contrast Continuous Application Security Plugin missing permission checks
Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform permission checks in several HTTP endpoints that fill list box options with the names of the configured Contrast metadata. This allows attackers with Overall/Read permission to enumerate the names of...
GHSA-429R-3J78-2PXM Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability
Jenkins Assembla Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to an Assembla server. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password...
GHSA-MPFF-XHG4-VR45 Jenkins MCP Server Plugin missing a permission check
Jenkins MCP Server Plugin 0.177.v629fdb2557fe and earlier does not perform a permission check in the getReplayScripts MCP tool that returns the replay script of a Pipeline build. This allows attackers with Item/Read permission to obtain the Pipeline script of jobs. MCP Server Plugin...
GHSA-2Q27-6P2H-Q6R3 Jenkins Assembla Plugin has an XXE vulnerability
Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when parsing responses from the configured Assembla server. This allows attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkin...
GHSA-43M2-HCMM-QPM7 Jenkins Zowe zDevOps Plugin has a CSRF vulnerability
Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b450b1 and earlier does not perform a permission check in an HTTP endpoint implementing a connection test. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained throu...
GHSA-XX59-JV36-5R44 Jenkins Zowe zDevOps Plugin has a missing permission check
Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b450b1 and earlier does not perform a permission check in an HTTP endpoint implementing a connection test. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained throu...
GHSA-2R5W-JH6G-8HFF Jenkins Assembla Plugin has a missing permission check
Jenkins Assembla Plugin 1.4 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to an Assembla server. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password...
GHSA-5QH3-HXX9-W26P Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE
Jenkins OWASP ZAP Plugin 1.0.7 and earlier does not support distributed builds, causing the file operations and build process of its "Automatically build ZAP" feature to be performed on the Jenkins controller rather than on the agent the build is assigned to. This allows attackers with...
GHSA-J4PH-WP3C-C37W Jenkins FitNesse Plugin stores passwords unencrypted
Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of thi...
GHSA-2X9C-VP3G-HVV2 Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability
Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs...
GHSA-C3JM-9VJ7-5V66 Jenkins Script Security Plugin sandbox bypass vulnerability
Jenkins Script Security Plugin provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type cast applied to each element of the...
GHSA-W794-RWP2-JC9M Jenkins Gitee Plugin has a cross-site request forgery vulnerability
Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier does not perform permission checks in several HTTP endpoints implementing form validation for its global configuration. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentia...
GHSA-G7C6-WXJF-8564 Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier does not perform a permission check in an HTTP endpoint that lists the GitHub API endpoints configured in the global plugin configuration. This allows attackers with Overall/Read permission to obtain the URLs of GitHub...
GHSA-JHCQ-6WQP-QCFX Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier does not correctly perform a permission check in an HTTP endpoint. This allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to enumerate credentials IDs of credentials stored in...
GHSA-WJMQ-RPQQ-W4H9 Jenkins Gitee Plugin missing permission checks
Jenkins Gitee Plugin 1288.v18bdebc9069b and earlier does not perform permission checks in several HTTP endpoints implementing form validation for its global configuration. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentia...
GHSA-8QR4-27MH-HQFR Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Jenkins Job Configuration History Plugin 1356.ve360da6c523a and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations through its "View as XML" / "RAW" feature and its configuration diff views. This allows attackers with Item/Extended Read...
GHSA-WP5X-HRRW-6R4G Jenkins Git client Plugin has an OS command injection vulnerability on agents
Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into the SSH wrapper script generated by the "Manually provided keys" Git Host Key Verification strategy on Unix agents. This allows attackers able to control the name of a build...
GHSA-HRMJ-8FM9-CG8X Jenkins External Workspace Manager Plugin has a path traversal vulnerability
Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject .. path segments when validating the custom workspace path provided to the exwsAllocate Pipeline step, allowing the resulting workspace path to escape the configured disk mount point. This allows attackers with...
GHSA-GX55-P8G7-P3FH Jenkins Active Directory Plugin has an LDAP injection vulnerability
In Jenkins Active Directory Plugin 2.41.1 and earlier, the Windows native ADSI authentication path does not escape the user name before building the LDAP search filter. This allows unauthenticated attackers to inject LDAP wildcard characters into the user name, enabling them to enumerate director...
GHSA-2W2H-GWWJ-FH3Q Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, instantiating any type with a constructor annotated with @DataBoundConstructor in response to a request. This allows attackers to have...
GHSA-CFJ9-2VGR-HPXP Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations such as @CompileStatic and @TypeChecked that carry an extensions member, which causes Groovy to load and execute a script from the classpath at compile time, before the sandbox is...
GHSA-9V77-J4XV-34GQ Jenkins EC2 Fleet Plugin has a missing permission check
Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a81c3 and earlier does not perform permission checks in several HTTP endpoints used to validate cloud configurations. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs...
GHSA-JWHR-H7PC-3974 Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for the connections it makes to Bitbucket Server using Bearer token authentication. Because the Bearer token is transmitted in these requests, this allows attacker...
GHSA-HWVP-7XQV-8JX3 Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca and earlier does not perform a permission check in an HTTP endpoint that populates the list of values for Git parameters by querying the SCM configured on a job, using the SCM credentials configured in Jenkins. This allows attackers with Item/Read...
GHSA-72C8-3WWG-R59W Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, instantiating any type with a constructor annotated with @DataBoundConstructor in response to a request. This allows attackers to have...
GHSA-P44Q-FMWR-JQR7 Jenkins Contrast Continuous Application Security Plugin has a missing permission check
Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specifi...
GHSA-FQ56-WVV2-P8JF Jenkins Priority Sorter Plugin has a CSRF vulnerability
Jenkins Priority Sorter Plugin 936.v2c01c6b84449 and earlier does not require POST requests in an HTTP endpoint that saves the global job priority configuration. This allows attackers to overwrite the global job priority configuration. Priority Sorter Plugin 936.937.v5581d0b2ccba requires POST...
GHSA-JJ69-4GRX-FQJ5 Duplicate Advisory: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wpqr-6v78-jr5g. This link is maintained to preserve external references. Original Description Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI versions prior to 0.39.1...
GHSA-PWPJ-P52H-Q484 Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support FMCS is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign companyi...
GHSA-6MMJ-JHQJ-6C6Q Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize call used by the local-file branch. Key evidenc...
GHSA-X667-R589-43M7 Snipe-IT has Improper Authorization in File Deletion (IDOR)
Impact A vulnerability was identified in Snipe-IT v8.4.0 build 21280-g91a95dbc6 that allows any authenticated user with generic asset edit permissions to delete files attached to any asset in the system, regardless of ownership or company assignment. This constitutes an Insecure Direct Object...
GHSA-HF68-G98V-WP9G Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation
Impact The store method in both the web and API UsersController only strips the superuser permission when a non-superuser creates a user. It does not strip the admin permission. This allows any authenticated user with the users.create permission to create a new user with full admin privileges. Th...