GHSA-4685-2X5R-65PJ Pebble service manager's file pull API allows access by any user

Impact Note: "Pebble" here refers to Canonical's service manager, not the Let's Encrypt ACME test server. The API behind pebble pull, used to read files from the workload container by Juju charms, allows access from any user, instead of just admin. In Juju Kubernetes sidecar charms, Pebble and th...

GHSA-552F-97WF-PMPQ Umbraco possible user enumeration

Impact A user enumeration attack is possible. Affected versions Umbraco 10 with access to the native login screen Patches This is fixed in 10.8.5 Workarounds Disabling the native login screen, by exclusively use external logins...

GHSA-MP76-7W5V-PR75 TurboBoost Commands vulnerable to arbitrary method invocation

Impact TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should be. It's possible for a sophisticated attacker to invoke more methods than should be permitted dependi...

BIT-TYPO3-2021-21355

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default...

BIT-REDMINE-2022-44030

Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user...

BIT-DISCOURSE-2022-39241 Possible Server-Side Request Forgery (SSRF) in webhooks

Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts on the internal network, as well as against hosts on the Internet. Latest stable, beta, and test-passed versions are now patched. As a...

BIT-MOODLE-2023-23921 Moodle: reflected xss risk in some returnurl parameters

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable...

BIT-PERCONA-XTRABACKUP-2022-25834

In Percona XtraBackup PXB through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected command shell execution of arbitrary commands...

BIT-NGINX-2021-23017

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact...

BIT-MINIO-2023-27589 Minio vulnerable to denial of access by an admin privileged user for root credential

Minio is a Multi-Cloud Object Storage framework. Starting with RELEASE.2020-12-23T02-24-12Z and prior to RELEASE.2023-03-13T19-46-17Z, a user with consoleAdmin permissions can potentially create a user that matches the root credential accessKey. Once this user is created successfully, the root...

BIT-CONSUL-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...

GHSA-GP6M-FQ6H-CJCX Magento LTS vulnerable to stored XSS in admin file form

Summary OpenMage is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Details MageAdminhtmlBlockSystemConfigFormFieldFile does not escape filename value in certain situations. Same...

GHSA-C9VV-FHGV-CJC3 agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

Impact The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using...

GHSA-FRXM-V7Q3-V2WV Insertion of Sensitive Information into Log File in OWASP DependencyCheck

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file...

GHSA-98G6-XH36-X2P7 Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability...

ALSA-2024:0001 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.6.0. Security Fixes: Mozilla: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver CVE-2023-6856 Mozilla: Memory safety bugs fixed in Firefox 121, Firefo...

GHSA-HWCC-4CV8-CF3H Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)

Issue Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List CRL were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between...

GHSA-RFQ3-WPJH-PPVG WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability

WSO2 Registry has been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

GHSA-RWF3-W4JQ-F4CM Directory Traversal in evershop

Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint...

GHSA-9V3J-4J64-P937 OroPlatform vulnerable to path traversal during temporary file manipulations

Impact Path Traversal is possible in Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. The file will be deleted...

GHSA-XX9P-XXVH-7G8J Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks

Impact Aiohttp has a security vulnerability regarding the inconsistent interpretation of the http protocol. As we know that HTTP/1.1 is persistent, if we have both Content-LengthCL and Transfer-EncodingTE it can lead to incorrect interpretation of two entities that parse the HTTP and we can poiso...

GHSA-M425-MQ94-257G gRPC-Go HTTP/2 Rapid Reset vulnerability

Impact In affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit...

GHSA-J2GJ-G3P9-7MRR Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. As of commit c9aa2eeb9 access tokens which fail validation are rejected...

GHSA-62PR-54GV-VG5G SpringBlade vulnerable to SQL injection

In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection...

GHSA-68XG-GQQM-VGJ8 Puma HTTP Request/Response Smuggling vulnerability

Impact Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. The following vulnerabilities are addressed by this advisory: Incorrect parsing of trailing fields in...

GHSA-RC33-44QP-VPVQ Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default. This allows unauthenticated attackers to trigger builds of...

GHSA-85CF-GJ29-F555 1Panel Arbitrary File Download vulnerability

Summary Any file downloading vulnerability exists in 1Panel backend. Details Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. PoC payload: POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json...

GHSA-GPCV-P28P-FV2P odoh-rs's Invalid Slice Split Results in Server Panic

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients. Impact An attacker with knowledge of this vulnerability could craft and...

GHSA-735F-W79P-282X pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name

Impact As HTML injection works in email an attacker can trick a victim to click on such hyperlinks to redirect him to any malicious site and also can host a XSS page. All this will surely cause some damage to the victim. This could lead to users being tricked into giving logins away to malicious...

GHSA-PHWM-87RG-27QQ XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

Impact It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. Patches The vulnerabilit...

GHSA-4WC6-HQV9-QC97 XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters

Impact A stored XSS can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload on the page title. Then, any user visiting /xwiki/bin/view/AppWithinMinutes/ClassEditSheet executes the payload. See...

GHSA-65WH-G8X8-GM2H Apache NiFi vulnerable to Deserialization of Untrusted Data

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

GHSA-GCJ9-JJ38-HWMC Vapor's Metrics integration could cause a system drain

Impact This is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app with the following attack vector: 1. send unlimited requests against a vapor instance with different paths. this will create “unlimited” counters and timers, which will eventually drain the system. 2...

GHSA-239C-6CV2-WWX8 Swift-corelibs-foundation denial of service in JSON decoding with JSONDecoder

Impact A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift...

CVE-2023-2804

A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2mergedupsampleinternal function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could cra...

GHSA-476G-V7HF-CW5M Cross-site Scripting (XSS) in Document Properties Parameter

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.21 or apply this patch manually...

DLA-3401-1 apache2 - security update

Bulletin has no description...

GHSA-MJW9-3F9F-JQ2W XWiki Platform vulnerable to code injection from view right on XWiki.ClassSheet

Impact Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous...

GHSA-MJG3-2V66-P34J Jenkins OctoPerf Load Testing Plugin missing permission check allows for ID enumeration

OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using...

DLA-3371-1 unbound - security update

Bulletin has no description...

GHSA-XG89-VVWP-9C27 Exposure of Sensitive Information in OpenGoofy Hippo4j

Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module...

GHSA-P2PF-G8CQ-3GQ5 teler-waf contains detection rule bypass via Entities payload

Description teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab...

GHSA-746G-3GFP-HFHW Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie

Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the...

GHSA-QCF5-M2C6-89F2 usememos/memos Improper Authorization vulnerability

usememos/memos 0.9.0 and prior is vulnerable to Improper Authorization...

GHSA-4WHF-RMX5-8FRV active_attr Improper Resource Shutdown or Release vulnerability

A vulnerability classified as problematic has been found in cgriego activeattr up to 0.15.3. This affects the function call of the file lib/activeattr/typecasting/booleantypecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit ha...

GHSA-F92P-F8R2-C87Q Tribal Systems Zenario CMS vulnerable to Cross-site Scripting

A vulnerability has been found in Tribal Systems Zenario CMS prior to version 8.5.51340. Affected by this issue is some unknown functionality of the file adminorganizer.js of the component Error Log Module. The manipulation leads to cross site scripting. The attack may be launched remotely. The...

PSF-2022-11 Buffer overflow in the _sha3 module in Python 3.10 and older

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface...

GHSA-XV7R-9VQ4-9WRQ Project Wonder WebObjects vulnerable to Arbitrary HTTP Header Injection and Cross-site Scripting

Project Wonder WebObjects 1.0 through 7.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces. A patch for this issue is available at commit number b0d2d74f13203268ea254b02552600850f28014b...

GHSA-7F6X-JWH5-M9R4 Cranelift vulnerable to miscompilation of constant values in division on AArch64

Impact There was a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors could result in incorrect division results at runtime. The translation rules for constants did not take into account whether sign- or zero-extension should happen, which resulted in an...

GHSA-R7V4-JWX9-WX43 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator

Background CILogon is a federated auth provider that allows users to authenticate themselves via a number of Identity Providers IdP, focused primarily on educational and research institutions such as Universities. More traditional and open IdPs such as GitHub, ORCID, Google, Microsoft, etc are al...