2102227 matches found
BIT-TENSORFLOW-2022-35989 `CHECK` fail in `MaxPool` in TensorFlow
TensorFlow is an open source platform for machine learning. When MaxPool receives a window size input array ksize with dimensions greater than its input tensor input, the GPU kernel gives a CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub comm...
BIT-TENSORFLOW-2022-35992 `CHECK` fail in `TensorListFromTensor` in TensorFlow
TensorFlow is an open source platform for machine learning. When TensorListFromTensor receives an elementshape of a rank greater than one, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 3db59a042a38f4338aa207922fa2f476e000a6ee. The fi...
BIT-TENSORFLOW-2022-36015 Integer overflow in math ops in TensorFlow
TensorFlow is an open source platform for machine learning. When RangeSize receives values that do not fit into an int64t, it crashes. We have patched the issue in GitHub commit 37e64539cd29fcfb814c4451152a60f5d107b0f0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this...
BIT-TENSORFLOW-2022-36018 `CHECK` fail in `RaggedTensorToVariant` in TensorFlow
TensorFlow is an open source platform for machine learning. If RaggedTensorToVariant is given a rtnestedsplits list that contains tensors of ranks other than one, it results in a CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit...
BIT-DISCOURSE-2022-31025 Invite bypasses user approval in Discourse
Discourse is an open source platform for community discussion. Prior to version 2.8.4 on the stable branch and 2.9.0 on the beta and tests-passed branches, inviting users on sites that use single sign-on could bypass the mustapproveusers check and invites by staff are always approved automaticall...
BIT-RUBY-2021-33621
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object...
BIT-MOODLE-2022-40208
In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt...
BIT-MATTERMOST-2023-2281
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team...
BIT-PINNIPED-2022-31677
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor before v0.19.0. A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow...
BIT-MOODLE-2023-23923 Moodle: possible to set the preferred "start page" of other users
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality...
BIT-LIVEHELPERCHAT-2021-4131
livehelperchat is vulnerable to Cross-Site Request Forgery CSRF...
BIT-MOODLE-2023-46858
Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content are used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."...
BIT-CODEIGNITER-2022-35943
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow SameSite Attackers to bypass the CodeIgniter4 CSRF protection mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct or indirect, e.g., XSS control over a...
BIT-GHOST-2022-41697
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability...
BIT-COUCHDB-2023-45725 Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output,...
GHSA-XPJG-7HX7-WGCX Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
Cross-site scripting XSS vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML v...
GHSA-22R3-9W55-CJ54 Pkg Local Privilege Escalation
Impact Any native code packages built by pkg are written to a hardcoded directory. On unix systems, this is /tmp/pkg/ which is a shared directory for all users on the same local system. There is no uniqueness to the package names within this directory, they are predictable. An attacker who has...
GHSA-3RFR-MPFJ-2JWQ Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
Impact You can create, delete etc. tags without having the permission to do so. This vulnerability allows an attacker to perform broken access control and add tags to admin panel and add dumy data. One can do this as intruder and add text parameters with random numbers and this will effect...
BIT-LIFERAY-2021-38263
Cross-site scripting XSS vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script...
GHSA-CWX6-4WMF-C6XV SQL Injection in Admin download files as zip
Summary The application allows to create zip files from available files on the site. The parameter "selectedIds", is susceptible to SQL Injection. Details downloadAsZipJobsAction escape parameters, but downloadAsZipAddFilesAction not. The following code should be added: foreach $selectedIds as...
GHSA-9RHQ-86FM-QXQC Duplicate Advisory: Hard-coded credentials in org.folio:mod-data-export-spring
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vf78-3q9f-92g3. This link is maintained to preserve external references. Original Description Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows...
GHSA-7HFX-H3J3-RWQ4 D-Tale server-side request forgery through Web uploads
Impact Users hosting D-Tale publicly can be vulnerable to server-side request forgery SSRF allowing attackers to access files on the server. Patches Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn...
GHSA-JJ93-39PF-7MCF bsock uses weak hashing algorithms
An issue was discovered in the bsock component of bcoin-org bcoin that allows remote attackers to obtain sensitive information via weak hashing algorithms in the component \vendor\faye-websocket.js...
GHSA-3RPX-PGMF-J96H Microweber Business Logic Errors
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.0. Unpublished and deleted products can be added to checkout...
GHSA-8HCR-5X2G-9F7J Deserialization of Untrusted Data in apache-submarine
Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests using application/yaml content-type, it defin...
GHSA-XVMV-4RX6-X6JX Authenticated users can view job names and groups they do not have authorization to view
Access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which provides a list of job names and groups for any project, without the necessary authorization checks. The affected URLs are: - https://host/context/rdJo...
GHSA-6F58-J323-6472 pimcore/admin-ui-classic-bundle Unverified Password Change
Impact As old password can be set as new password , it is considered as password policy violation. Pimcore is not enforcing strict password policy which allow attacker to set old password as new password Proof of Concept 1. Go to Admin link 2. login and click on - "User | My Profile". 3. Go to...
GHSA-PQGM-9G82-WCM7 modoboa Cross-site Scripting vulnerability
Cross-site Scripting XSS - DOM in GitHub repository modoboa/modoboa prior to 2.2.2...
GHSA-8WX3-324G-W4QQ OpenSearch uncontrolled resource consumption
Impact An issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering an...
GHSA-997J-37H7-MHG9 CSRF vulnerability in Jenkins AWS CodeCommit Trigger Plugin
A cross-site request forgery CSRF vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue...
GHSA-8RJ5-2857-877J json2xml Uncaught Exception vulnerability
The json2xml package for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service...
GHSA-68XG-GQQM-VGJ8 Puma HTTP Request/Response Smuggling vulnerability
Impact Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. The following vulnerabilities are addressed by this advisory: Incorrect parsing of trailing fields in...
GHSA-3VF5-XM2P-6MH5 Cockpit Cross-site Scripting vulnerability
Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit 2.6.2 and prior. A patch is available at commit 34ab31ee9362da51b9709e178469dbffd7717249...
GHSA-8HX6-QV6F-XGCW MindsDB can be made to not verify SSL certificates
Summary MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with verify=False disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In versi...
GHSA-PM73-X2H5-CMJ3 Apache StreamPipes Improper Privilege Management vulnerability
A REST interface in Apache StreamPipes versions 0.69.0 to 0.91.0 was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0...
GHSA-2FQM-M4R2-FH98 kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. Th...
GHSA-MJ6P-3PC9-WF5M proxy denial of service vulnerability
A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP request. Usage of the undefined variable raises a TypeError exception...
GHSA-GPQ5-7P34-VQX5 XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
Impact It's possible to display any page you cannot access through the combination of the async and display macro. Steps to reproduce: 1. Enable comments for guests by giving guests comment rights 2. As a guest, create a comment with content asyncdisplay reference="Menu.WebHome" //async 3. Open t...
GHSA-WG4W-5M5R-W3P8 OpenAPI Generator vulnerable to Server-Side Request Forgery
openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery SSRF via the component /api/gen/clients/language. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request...
UBUNTU-CVE-2023-28099
OpenSIPS is a Session Initiation Protocol SIP server implementation. Prior to versions 3.1.9 and 3.2.6, if dsisinlist is used with an invalid IP address string NULL is illegal input, OpenSIPS will attempt to print a string from a random address stack garbage, which could lead to a crash. All user...
GHSA-C737-JHWR-FQXJ Duplicate Advisory: Cross Site Scripting in eZ Platform Ibexa Kernel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mrvj-7q4f-5p42. This link is maintained to preserve external references. Original Description Impact In file upload it is possible by certain means to upload files like .html and .js. These may contain XSS...
GHSA-VXHR-P2VP-7GF8 Answer vulnerable to Cross-site Scripting
Cross-site Scripting XSS - Reflected in GitHub repository answerdev/answer prior to 1.0.6...
GHSA-J9CW-5CPJ-9QJ5 Moodle has a Hidden Functionality vulnerability
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk...
GHSA-JWR6-75XH-JH5J Synopsys Jenkins Coverity Plugin has Incorrect Default Permissions
Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using anothe...
GHSA-P52G-CM5J-MJV4 openssl-src subject to Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages fo...
GHSA-GVFJ-FXX3-J323 mellium.im/sasl authentication failure due to insufficient nonce randomness
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...
GHSA-6XRF-Q977-5VGC json-pointer vulnerable to Prototype Pollution
A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes 'prototype pollution'. The attack may be...
UBUNTU-CVE-2022-23485
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...