2105697 matches found
GHSA-F4M6-X2XJ-JC7W ke_search (aka Faceted Search) vulnerable to Cross-Site Scripting
The kesearch aka Faceted Search extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data...
GHSA-4882-HXPR-HRVM @udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme
Impact Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. Patches...
GHSA-353F-5XF4-QW67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash //. This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files. Steps to Fix. Update Vite: Ensure that you are...
GHSA-JV3F-7M33-QP65 Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
Impact Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. Reported-By Thanks to the report from Mio Li [email protected] Patches commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 Author: Daniel Valdivia Date: Tue May 23 08:47:12 2023 -0700 Replace RIGHT-TO-LEFT...
GHSA-WVHW-5M89-64GV Cross-site scripting in Liferay Portal
Cross-site scripting XSS vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object...
GHSA-MJMF-7WJW-F5XX Jenkins Code Dx Plugin missing permission checks
Jenkins Code Dx Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request...
GHSA-HMM7-6PH9-8JF2 org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Basic Cross-site Scripting
Impact A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. For instance, by adding the LiveData below in the about section of the profile of a user created by an admin. javascript liveData id="movie...
GHSA-9PC2-X9QF-7J2Q org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability
Impact Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the macro parameters of the...
GHSA-C24F-2J3G-RG48 kaml has potential denial of service while parsing input with anchors and aliases
Impact Applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Patches Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. Workarounds None. References Wikipedia has an explanation ...
GHSA-QQ2J-9PF8-G58C Company admin role gives excessive privileges in eZ Platform Ibexa
Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is typically only given to...
GHSA-9J2P-8QQF-H55C Cross-site Scripting in UDX Stateless Media Plugin
A vulnerability was found in UDX Stateless Media Plugin 3.1.1. It has been declared as problematic. This vulnerability affects the function setupwizardinterface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be...
GHSA-79WQ-G4V9-GFJ4 Publify Core does not strip metadata from images
Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10...
GHSA-9H7X-9PMH-7GG8 usememos/memos vulnerable to stored Cross-site Scripting
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
GHSA-6MJP-2RM6-9G85 XWiki CKEditor.HTMLConverter vulnerable to Remote Code Execution via Cross-Site Request Forgery
Impact The CKEditor.HTMLConverter document lacked a protection against Cross-Site Request Forgery CSRF, allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters...
GHSA-V92P-PHMP-XFFR usememos/memos vulnerable to stored Cross-site Scripting
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
GHSA-P86X-75J8-W4XH Stored XSS vulnerability in Jenkins Checkmarx Plugin
heckmarx Plugin processes Checkmarx service API responses and generates HTML reports from them for rendering on the Jenkins UI. Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports. This results in a stored...
GHSA-J7QP-MFXF-8XJW libp2p DoS vulnerability from lack of resource management
Impact Versions older than v0.18.0 of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed ...
GHSA-M5XF-X7Q6-3RM7 KubeVela VelaUX APIserver has SSRF vulnerability
Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: 50...
GHSA-8G2P-5PQH-5JMC .NET Information Disclosure Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET, .NET Core and .NET Framework's System.Data.SqlClient and Microsoft.Data.SqlClient NuGet Packages. A vulnerability exists in System.Data.SqlClient and Microsoft.Data.SqlClient libraries where a...
GHSA-3GFJ-FXX4-F22W OpenFGA Authorization Bypass
Overview During our internal security assessment, it was discovered that OpenFGA versions v0.2.4 and prior are vulnerable to authorization bypass under certain conditions. Am I Affected? You are affected by this vulnerability if you are using openfga/openfga version v0.2.4 or prior, and have tupl...
GO-2022-1086 Server-side request forger via X-Skipper-Proxy in github.com/zalando/skipper
An attacker can access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Proxy to the http request...
GHSA-2JXG-MV2M-J4R7 Moodle type juggling vulnerability
An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability...
GHSA-9MMC-27GW-W6MQ Bytebase allows low-privilege users to view admin projects
Overview The "Bytebase" application does not restrict low privilege user from accessing admin projects Details The "Bytebase" application does not restrict low privilege user from accessing admin projects for which an unauthorized user can view the "projects" created by "Admin". The affected...
GHSA-9RWJ-9J2H-FHVM Toast UI Grid vulnerable to Cross-site Scripting
Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds...
GHSA-936V-CG49-M2G5 com.google.cloud.tools:jib-core vulnerable to Remote Code Execution (RCE)
The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution RCE via the isDockerInstalled function, due to attempting to execute input...
GHSA-F92V-GRC2-W2FG Ethermint vulnerable to DoS through unintended Contract Selfdestruct
Vulnerability Report Impact Smart contract applications that make use of the selfdestruct functionality and their end-users. Classification The vulnerability has been classified as high with a CVSS score of 8.2. It has the potential to create a denial-of-service to all contracts that can invoke t...
GHSA-8RMH-55H4-93H5 DSpace ItemImportService API Vulnerable to Path Traversal in Simple Archive Format Package Import
Impact ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF simple archive format package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. However, this path traversal vulnerability is only possible...
GHSA-CJ7G-H7RF-H8J9 Apache Superset OS Command Injection
While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s os package in the web application process in versions 0.37.1. It was thus...
GHSA-MQR8-3V8J-46WV Missing Authorization in Jenkins Configuration as Code Plugin
Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins...
GHSA-W898-3PH8-5PGM Jenkins Self-Organizing Swarm Plug-in Modules Plugin XXE vulnerability via UDP broadcast response
Jenkins Swarm Plugin allows clients to auto-discover Jenkins instances on the same network through a UDP discovery request. Responses to this request are XML documents. Swarm Plugin does not configure the XML parser in a way that would prevent XML External Entity XXE processing. This allows...
GHSA-H6P6-FC4W-CQHX Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. dot dot in a resource URI...
GHSA-H2FP-XGX6-XH6F Pallets Werkzeug cross-site scripting vulnerability
Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...
GHSA-8WP2-VXPG-XCVP Cross site scripting in facturascripts
facturasripts is an open source ERP software. Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can...
GHSA-93P5-8FQW-WJX3 Authentication bypass by capture-replay in github.com/cosmos/ethermint
Cosmos Network Ethermint = v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application. Specific Go Packages Affected github.com/cosmos/ethermint/rpc/namespaces/eth...
GHSA-6HV3-7C34-4HX8 Hashicorp Nomad Information Exposure Through Environmental Variables
In Nomad before version 0.9.5, when rendering a task template, all environment variables were available to the rendering task. As a fix, only task environment variables are used...
GHSA-VFP4-XX6M-7VF6 Cryptographic Issues in ECK
Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...
GHSA-C58C-W527-H77P Deserialization of untrusted data in Apache Cayenne
Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence ROP feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and...
GHSA-JQMC-79GX-7G8P Incorrect Permission Assignment for Critical Resource in CRI-O
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace...
GHSA-M6J2-V3GQ-45R5 Cross-site Scripting in aurelia-framework
The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via for example JavaScript code in an...
GHSA-2XW8-J43J-5VXP elgg is vulnerable to Cross-site Scripting
elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
GHSA-C4RH-4376-GFF4 Improper certificate management in AWS IoT Device SDK v2
The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store...
DLA-2802-1 elfutils - security update
Bulletin has no description...
GHSA-536P-4PCJ-5MR9 raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh wit...
GHSA-VQX7-PW4R-29RR Out of bounds read in bumpalo
An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys...
GHSA-HV87-47H9-JCVQ Uncontrolled recursion in rust-yaml
Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth...
GHSA-WVHV-RR3V-VHPJ Out-of-bounds write in ChakraCore
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829,...
GHSA-5WRH-4JWV-5W78 Open redirect via transitional IPv6 addresses on dual-stack networks
Impact Requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL...
DLA-2091-1 libjackson-json-java - security update
Bulletin has no description...
GHSA-4MVC-QC5W-V5QR Information disclosure in the Contao backend
Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If...