Lucene search
+L
OsvMost viewed

997986 matches found

OSV
OSV
added 2024/03/06 3:22 p.m.100 views

GHSA-H5GF-CMM8-CG7C CasaOS-UserService allows unauthorized access to any file

Summary http://demo.casaos.io/v1/users/image?path=/var/lib/casaos/1/avatar.png Originally it was to get the url of the user's avatar, but the path filtering was not strict, making it possible to get any file on the system. Details Construct paths to get any file. Such as the CasaOS user database,...

7.5CVSS8.5AI score0.00971EPSS
SaveExploits1References5
OSV
OSV
added 2024/03/05 8:54 p.m.100 views

GHSA-M4PQ-FV2W-6HRW Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping

Summary A maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Details In the patch for CVE-2023-28446, Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to t...

8.8CVSS7AI score0.00943EPSS
SaveExploits1References5
OSV
OSV
added 2024/02/19 9:30 a.m.100 views

GHSA-4G9R-VXHX-9PGX Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue...

5.9CVSS6.8AI score0.00441EPSS
SaveExploits0References6
OSV
OSV
added 2024/01/09 6:28 p.m.100 views

GHSA-8G9C-28FC-MCX2 Duplicate Advisory: Microsoft Identity Denial of service vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-59j7-ghrg-fj52. This link is maintained to preserve external references. Original Description Impact An attacker could exploit this vulnerability by crafting a malicious JSON Web Encryption JWE token with a high...

6.8CVSS7.3AI score
SaveExploits0References7
OSV
OSV
added 2023/10/17 12:41 p.m.100 views

GHSA-9WMC-RG4H-28WV github.com/kumahq/kuma affected by CVE-2023-44487

Impact Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RSTSTREAM frames. This can be exercised if you use the builtin gateway and receive untrusted http2 traffic. Patches...

7.5CVSS7.8AI score
SaveExploits0References11
OSV
OSV
added 2023/10/04 6:52 p.m.100 views

GHSA-43CP-6P3Q-2PC4 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

Impact The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. Specifically, the requirements for the vulnerability are: 1. Allowing one foreign element: svg, or math 2. Comments or one raw text element: iframe,...

6.1CVSS6.1AI score0.00363EPSS
SaveExploits0References4
OSV
OSV
added 2023/09/21 5:10 p.m.100 views

GHSA-CXVP-82CQ-57H2 blurhash panics on parsing crafted inputs

Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-...

8.6CVSS7.9AI score0.00515EPSS
SaveExploits0References4
OSV
OSV
added 2023/08/16 9:2 p.m.100 views

GHSA-4GCF-5M39-98MC Woodpecker does not validate webhook before changing any data

Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. Patches Please use either nex...

8.1CVSS8AI score0.00716EPSS
SaveExploits0References7
OSV
OSV
added 2023/08/08 6:15 p.m.100 views

CVE-2023-20569

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure...

4.7CVSS6.7AI score
SaveExploits0References12
OSV
OSV
added 2023/03/01 5:38 p.m.100 views

GHSA-9HHC-PJ4W-W5RV Keycloak Cross-site Scripting on OpenID connect login service

A reflected cross-site scripting XSS vulnerability was found in the oob OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page...

8.1CVSS6.8AI score0.01149EPSS
SaveExploits0References11
OSV
OSV
added 2022/11/18 6:50 p.m.100 views

GHSA-HC82-W9V8-83PR Witness Block Parsing DoS Vulnerability

Impact All lnd nodes before version v0.15.4 are vulnerable to a block parsing bug that can cause a node to enter a degraded state once encountered. In this degraded state, nodes can continue to make payments and forward HTLCs, and close out channels. Opening channels is prohibited, and also on...

8.2CVSS7AI score0.00999EPSS
SaveExploits1References6
OSV
OSV
added 2022/10/25 8:22 p.m.100 views

GHSA-F2RJ-M42R-6JM2 Skipper vulnerable to SSRF via X-Skipper-Proxy

Impact Skipper prior to version v0.13.236 is vulnerable to server-side request forgery SSRF. An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header X-Skipper-Proxy to the http request. Patches The...

9.8CVSS9.5AI score0.10867EPSS
SaveExploits3References12
OSV
OSV
added 2022/09/16 5:41 p.m.100 views

GHSA-XG8P-34W2-J49J linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

Impact What kind of vulnerability is it? Who is impacted? This vulnerability impacts all the initialization functions on the Heap and LockedHeap types, including Heap::new, Heap::init, Heap::initfromslice, and LockedHeap::new. It also affects multiple uses of the Heap::extend method. Initializati...

8.4CVSS9.1AI score0.00761EPSS
SaveExploits1References6
OSV
OSV
added 2022/05/24 7:2 p.m.100 views

GHSA-2259-H742-5VR4 JBoss EJB Client information disclosure vulnerability

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality...

4.3CVSS5.3AI score0.00743EPSS
SaveExploits0References2
OSV
OSV
added 2022/05/24 5:28 p.m.100 views

GHSA-79H8-7735-V3F9 System command execution vulnerability in Selection tasks Jenkins Plugin

Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as...

8.8CVSS8.9AI score0.01623EPSS
SaveExploits0References4
OSV
OSV
added 2022/05/13 1:31 a.m.100 views

GHSA-3FJ7-9J8M-7R8G Moodle Stored HTML in assignment submission comments allowed links to be opened directly

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly in the same window. Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more...

6.1CVSS5.5AI score0.0082EPSS
SaveExploits0References8
OSV
OSV
added 2022/05/13 1:19 a.m.100 views

GHSA-5P4H-3377-7W67 golang.org/x/net/html NULL Pointer Dereference vulnerability

The html package aka x/net/html before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of , , or . This is related to HTMLTreeBuilder.cpp in WebKit...

7.5CVSS7.4AI score0.02774EPSS
SaveExploits1References12
OSV
OSV
added 2022/05/13 1:11 a.m.100 views

GHSA-P739-9479-5WR2 jqueryFileTree vulnerable to Directory Traversal

jqueryFileTree 2.1.5 and older is vulnerable to Directory Traversal POC: bash curl 'http://localhost:8000/js/jqueryfiletree-2.1.5/dist/connectors/jqueryFileTree.php' -H 'Referer: xxx' -d "dir=/"...

7.5CVSS7.2AI score0.59063EPSS
SaveExploits7References3
OSV
OSV
added 2022/02/09 12:45 a.m.100 views

GHSA-FMJ2-7WX8-QJ4V Server-side request forgery (SSRF) in Apache XmlGraphics Commons

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

8.2CVSS7.4AI score0.0665EPSS
SaveExploits0References12
OSV
OSV
added 2022/02/07 10:38 p.m.100 views

GHSA-MMJ4-777P-FPQ9 Validation bypass in frourio-express

日本語 影響 v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。 パッチ frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには class-transformer と reflect-metadata の依存への追加も必要となります。 ワークアラウンド...

8.1CVSS8.4AI score0.01244EPSS
SaveExploits0References4
OSV
OSV
added 2021/10/28 12:0 a.m.100 views

DSA-4994-1 bind9 - security update

Bulletin has no description...

5.3CVSS6AI score0.08067EPSS
SaveExploits0
OSV
OSV
added 2021/08/25 8:50 p.m.100 views

GHSA-PF3P-X6QJ-6J7Q mio invalidly assumes the memory layout of std::net::SocketAddr

The mio crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the...

5.5CVSS5.3AI score0.00389EPSS
SaveExploits1References6
OSV
OSV
added 2021/06/16 5:47 p.m.100 views

GHSA-QJWC-V72V-FQ6R HTTP request smuggling in Undertow

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

4.8CVSS6.2AI score0.01119EPSS
SaveExploits0References4
OSV
OSV
added 2021/04/06 5:32 p.m.100 views

GHSA-PRMC-5V5W-C465 Client TLS credentials sent raw to server in npm package nats

Nats is a Node.js client for the NATS messaging system. Problem Description Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The...

7.5AI score
SaveExploits0References2
OSV
OSV
added 2019/08/13 12:0 a.m.100 views

DLA-1885-1 linux-4.9 - security update

Bulletin has no description...

9.3CVSS7.1AI score0.05111EPSS
SaveExploits6
OSV
OSV
added 2019/02/18 11:50 p.m.100 views

GHSA-238X-Q7XF-P4XW arrayfire-js downloads Resources over HTTP

Affected versions of arrayfire-js insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

8.5CVSS7.6AI score0.01354EPSS
SaveExploits0References3
OSV
OSV
added 2015/09/13 12:0 a.m.100 views

DSA-3358-1 php5 - security update

Bulletin has no description...

9.8CVSS7.8AI score0.46801EPSS
SaveExploits8
OSV
OSV
added 2013/05/26 12:0 a.m.100 views

DSA-2694-1 spip - privilege escalation

Bulletin has no description...

7.5CVSS6.3AI score0.08982EPSS
SaveExploits4
OSV
OSV
added 2026/05/12 12:12 a.m.99 views

GHSA-G7CV-RXG3-HMPX Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow...

9.6CVSS5.8AI score0.02342EPSS
SaveExploits3References8
OSV
OSV
added 2026/01/29 12:44 a.m.99 views

CGA-29W5-PM2P-PQ8V

Bulletin has no description...

7.5CVSS5.8AI score0.01392EPSS
SaveExploits1
OSV
OSV
added 2026/01/21 11:0 p.m.99 views

GHSA-36P8-MVP6-CV38 Wrangler affected by OS Command Injection in `wrangler pages deploy`

Summary A command injection vulnerability CWE-78 has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash t...

7.7CVSS6AI score0.01393EPSS
SaveExploits0References6
OSV
OSV
added 2024/12/23 6:30 p.m.99 views

GHSA-77PM-W3HX-F8MJ Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s servic...

8.7CVSS5.9AI score0.01509EPSS
SaveExploits1References10
OSV
OSV
added 2024/10/13 7:12 p.m.99 views

BIT-MLFLOW-2024-3099

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service DoS as an authenticated user might not be able to use the intended model, as it will open a different model each time...

5.4CVSS5.1AI score0.00438EPSS
SaveExploits1References1
OSV
OSV
added 2024/08/07 2:15 p.m.99 views

UBUNTU-CVE-2024-43199

Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user...

8.8CVSS5.8AI score0.01097EPSS
SaveExploits0References5
OSV
OSV
added 2024/07/31 7:57 p.m.99 views

GHSA-55P7-V223-X366 IdentityServer Open Redirect vulnerability

Impact It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Affected Methods - In the...

5.1CVSS4.6AI score
SaveExploits0References4
OSV
OSV
added 2024/07/16 7:32 p.m.99 views

GHSA-Q5FM-55C2-V6J9 Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib

Summary Vulnerability scan of fiona shows CVE-2023-45853. The vulnerability is in GDAL, a dependency of fiona. Details Fiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a...

9.8CVSS7.7AI score
SaveExploits0References5
OSV
OSV
added 2024/06/02 10:30 p.m.99 views

GHSA-CJCC-P67M-7QXM Unsafe Reflection in base Component class in yiisoft/yii2

Yii2 supports attaching Behaviors to Components by setting properties having the format 'as '. Internally this is done using the set magic method. If the value passed to this method is not an instance of the Behavior class, a new object is instantiated using Yii::createObject$value. However, ther...

8.1CVSS8.3AI score0.80085EPSS
SaveExploits1References9
OSV
OSV
added 2024/05/15 12:7 p.m.99 views

BIT-CILIUM-2023-39347 Cilium NetworkPolicy bypass via pod labels

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on pod update, Cilium incorrectly uses user-provided pod labels...

9CVSS8.2AI score0.0046EPSS
SaveExploits1References3
OSV
OSV
added 2024/03/06 11:8 a.m.99 views

BIT-SYMFONY-2020-5274

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the ErrorHandler rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the...

5.5CVSS5.2AI score0.01197EPSS
SaveExploits0References3
OSV
OSV
added 2024/01/23 8:10 p.m.99 views

GHSA-7Q8P-9953-PXVR Remote Command Execution in SOFARPC

Impact SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian...

9.8CVSS9.6AI score0.00799EPSS
SaveExploits0References5
OSV
OSV
added 2023/11/15 2:53 p.m.99 views

GHSA-72HH-XF79-429P Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()

Summary User input passed directly into an SQL statement allows non-admin backend users to execute arbitrary SQL statements. Details The /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for at...

8.8CVSS9.2AI score0.01218EPSS
SaveExploits1References6
OSV
OSV
added 2023/09/07 12:56 p.m.99 views

GHSA-8XV7-89VJ-Q48C Information disclosure in AccessControl

Impact Python's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...

6.8CVSS7AI score0.00519EPSS
SaveExploits0References4
OSV
OSV
added 2023/09/06 7:50 p.m.99 views

GHSA-P7V2-P9M8-QQG7 Electron context isolation bypass via nested unserializable return value

Impact Apps using contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds This issue is exploitable under eithe...

6CVSS7.2AI score0.0049EPSS
SaveExploits0References4
OSV
OSV
added 2023/09/04 4:39 p.m.99 views

GHSA-G2XH-C426-V8MF Vyper: reversed order of side effects for some operations

Impact For the following probably non-exhaustive list of expressions, the compiler evaluates the arguments from right to left instead of left to right. - unsafeadd - unsafesub - unsafemul - unsafediv - powmod256 - |, &, ^ bitwise operators - bitwiseor deprecated - bitwiseand deprecated - bitwisex...

6.9CVSS4.5AI score0.00418EPSS
SaveExploits1References7
OSV
OSV
added 2023/08/23 5:50 p.m.99 views

GHSA-C8XW-VJGF-94HR Argo CD web terminal session doesn't expire

Impact All versions of Argo CD starting from v2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open fo...

7.1CVSS5.5AI score0.00484EPSS
SaveExploits1References4
OSV
OSV
added 2023/03/18 9:30 p.m.99 views

GHSA-PMHG-CMJC-3875 Ansible Semaphore mishandles authentication

api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication...

9.8CVSS9.4AI score0.00873EPSS
SaveExploits0References4
OSV
OSV
added 2022/11/10 11:58 p.m.99 views

GHSA-8H83-CHH2-FCHP eZ Platform users with the Company admin role can assign any role to any user

Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...

7.2CVSS6.9AI score0.00862EPSS
SaveExploits0References4
OSV
OSV
added 2022/09/23 4:32 p.m.99 views

GHSA-WF7G-7H6H-678V Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console

An issue was discovered in Keycloak allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOADSCRIPTS feature is disabled...

7.2CVSS7.6AI score0.00944EPSS
SaveExploits0References6
OSV
OSV
added 2022/06/17 12:13 a.m.99 views

GHSA-P6GJ-GPC8-F8XW Aliased mutable references from `tls_rand` & `TlsWyRand`

TlsWyRand's implementation of Deref unconditionally dereferences a raw pointer, and returns multiple mutable references to the same object, which is undefined behavior...

9.8CVSS9.4AI score0.01191EPSS
SaveExploits0References3
OSV
OSV
added 2022/05/13 1:54 a.m.99 views

GHSA-7VPQ-G998-QPV7 Netty denial of service vulnerability

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service memory consumption via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames...

5CVSS7.8AI score0.04326EPSS
SaveExploits0References18
Total number of security vulnerabilities5000