Lucene search
+L
OsvMost viewed

996628 matches found

OSV
OSV
added 2024/09/25 5:37 a.m.64 views

CGA-X2WV-7P28-8WFG

Bulletin has no description...

4.3CVSS4.8AI score0.00711EPSS
SaveExploits0
OSV
OSV
added 2024/09/21 1:21 p.m.64 views

CGA-2PRX-F32M-4R4C

Bulletin has no description...

5.5CVSS4.5AI score0.00262EPSS
SaveExploits0
OSV
OSV
added 2024/09/09 6:16 p.m.64 views

GHSA-QWGC-RR35-H4X9 External Secrets Operator vulnerable to privilege escalation

Details The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets...

8.3CVSS8.7AI score0.00591EPSS
SaveExploits0References8
OSV
OSV
added 2024/09/04 8:15 p.m.64 views

UBUNTU-CVE-2024-44981

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix UBSAN 'subtraction overflow' error in shiftandmask UBSAN reports the following 'subtraction overflow' error when booting in a virtual machine on Android: | Internal error: UBSAN: integer subtraction overflow:...

5.5CVSS6.6AI score0.00193EPSS
SaveExploits0References5
OSV
OSV
added 2024/08/22 9:30 a.m.64 views

GHSA-HRF9-RM95-FPF3 Mattermost Cross-Site Request Forgery vulnerability

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

5.1CVSS6.3AI score0.00201EPSS
SaveExploits0References3
OSV
OSV
added 2024/08/01 3:32 p.m.64 views

GHSA-CMC8-222C-VQP9 Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels...

9.3CVSS7.3AI score0.00341EPSS
SaveExploits0References4
OSV
OSV
added 2024/07/31 3:21 p.m.64 views

GHSA-WF3X-JCCF-5G5G XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

Impact When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the victim into uploading a file with a malicious name. The malicious code is solely executed during the upload and affects only the user...

8.7CVSS5.4AI score0.15804EPSS
SaveExploits1References10
OSV
OSV
added 2024/07/22 12:30 p.m.64 views

GHSA-Q9W2-H4CW-8GHP Apache RocketMQ Vulnerable to Unauthorized Exposure of Sensitive Data

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist...

6CVSS7AI score0.0089EPSS
SaveExploits0References5
OSV
OSV
added 2024/07/18 12:0 a.m.64 views

ALSA-2024:4620 Important: libndp security update

Libndp is a library used by NetworkManager that provides a wrapper for the IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages. Security Fixes: libndp: buffer overflow in route information length field CVE-2024-5564 For more details about...

8.1CVSS8.6AI score0.01165EPSS
SaveExploits0References4
OSV
OSV
added 2024/06/17 10:30 p.m.64 views

GHSA-6GR4-52W6-VMQX rke's credentials are stored in the RKE1 Cluster state ConfigMap

Impact When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include the following sensitive data: -...

9.9CVSS9.1AI score0.0066EPSS
SaveExploits0References6
OSV
OSV
added 2024/06/15 12:0 a.m.64 views

OPENSUSE-SU-2024:10438-1 freetype2-devel-2.7-1.1 on GA media

These are all security issues fixed in the freetype2-devel-2.7-1.1 package on the GA media of openSUSE Tumbleweed...

10CVSS7.4AI score0.08541EPSS
SaveExploits27References55
OSV
OSV
added 2024/05/28 8:20 p.m.64 views

GHSA-J6CV-98JX-MRWR Mocodo vulnerable to SQL injection in `/web/generate.php`

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sqlcase input field in /web/generate.php, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution RCE under certain conditions...

9.8CVSS10AI score0.02744EPSS
SaveExploits1References5
OSV
OSV
added 2024/05/22 12:0 a.m.64 views

ALSA-2024:3271 Important: bind and dhcp security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. The Dynamic Hos...

7.5CVSS8.3AI score0.99995EPSS
SaveExploits1References8
OSV
OSV
added 2024/05/21 9:30 p.m.64 views

GHSA-JQFF-8G2V-642H NASA AIT-Core vulnerable to remote code execution

An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands...

9.8CVSS7.3AI score0.00546EPSS
SaveExploits2References3
OSV
OSV
added 2024/05/14 3:32 p.m.64 views

GHSA-V435-XC8X-WVR9 Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")

An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing...

5.9CVSS5.9AI score0.00901EPSS
SaveExploits1References8
OSV
OSV
added 2024/05/07 10:33 p.m.64 views

GO-2024-2824 Malformed DNS message can cause infinite loop in net

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop...

5.9CVSS6.4AI score0.01001EPSS
SaveExploits0References3
OSV
OSV
added 2024/05/07 3:30 p.m.64 views

GHSA-299Q-3P96-5898 Apache Superset Incorrect Authorization vulnerability

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue...

4.3CVSS4.3AI score0.00699EPSS
SaveExploits0References3
OSV
OSV
added 2024/05/01 8:29 a.m.64 views

GHSA-4JRX-5W4H-3GPM Navidrome Parameter Tampering vulnerability

Summary Parameter tampering is a vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. Details The attacker is able to change the parameter values in the body and successfully impersonate another user. In this case, the attacker created a playlist,...

4.2CVSS4.2AI score0.00413EPSS
SaveExploits1References3
OSV
OSV
added 2024/04/30 12:30 a.m.64 views

GHSA-6362-GV4M-53WW Calico privilege escalation vulnerability

In vulnerable versions of Calico v3.27.2 and below, Calico Enterprise v3.19.0-1, v3.18.1, v3.17.3 and below, and Calico Cloud v19.2.0 and below, an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. T...

8.6CVSS6.8AI score0.0022EPSS
SaveExploits0References8
OSV
OSV
added 2024/04/03 10:49 a.m.64 views

BIT-ARGO-CD-2024-29893 Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out o...

6.5CVSS6.4AI score0.00972EPSS
SaveExploits0References5
OSV
OSV
added 2024/04/02 12:30 a.m.64 views

GHSA-22V7-V3MJ-PM8R Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability

Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateDirectory...

8.8CVSS9.2AI score0.72319EPSS
SaveExploits0References5
OSV
OSV
added 2024/03/31 6:17 p.m.64 views

BIT-ESPOCRM-2024-24818

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2...

5.9CVSS5.6AI score0.00615EPSS
SaveExploits1References2
OSV
OSV
added 2024/03/21 10:10 p.m.64 views

CVE-2024-28863 node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few...

6.5CVSS6.1AI score
SaveExploits0References5
OSV
OSV
added 2024/03/06 11:7 a.m.64 views

BIT-PHP-2020-7059 OOB read in php_strip_tags_ex

When using fgetss function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash...

9.1CVSS8.2AI score0.07116EPSS
SaveExploits1References15
OSV
OSV
added 2024/03/06 11:6 a.m.64 views

BIT-PHP-2020-7065 mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mbstrtolower function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution...

8.8CVSS8.8AI score0.04764EPSS
SaveExploits1References9
OSV
OSV
added 2024/03/06 11:4 a.m.64 views

BIT-DISCOURSE-2022-36068 Discourse moderators can edit themes via the API

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a moderator can create new and edit existing themes by using the API when they should not be able to do so. The problem is patched in...

7.2CVSS5.3AI score0.00735EPSS
SaveExploits0References4
OSV
OSV
added 2024/03/06 11:4 a.m.64 views

BIT-PARSE-2020-5251 Information disclosure in parse-server

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way...

7.7CVSS6.1AI score0.00849EPSS
SaveExploits0References3
OSV
OSV
added 2024/03/06 11:3 a.m.64 views

BIT-PRESTASHOP-2023-39526 PrestaShopSQL manager vulnerability (potential RCE)

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds...

10AI score
SaveExploits0References3
OSV
OSV
added 2024/03/06 11:1 a.m.64 views

BIT-MATTERMOST-2023-2515

Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin...

8.8CVSS6.3AI score0.00469EPSS
SaveExploits0References2
OSV
OSV
added 2024/03/06 11:1 a.m.64 views

BIT-PARSE-2022-39313 Parse Server crashes when receiving file download request with invalid byte range

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been...

7.5CVSS7.3AI score0.00708EPSS
SaveExploits0References2
OSV
OSV
added 2024/03/06 11:0 a.m.64 views

BIT-DISCOURSE-2023-23620 Discourse restricted tag routes leak topic information

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and 3.1.0.beta2 on the beta and tests-passed branches, the contents of latest/top routes for restricted tags can be accessed by unauthorized users. This issue is patched in version 3.0.1 on the stable...

5.3CVSS5.4AI score0.00669EPSS
SaveExploits0References4
OSV
OSV
added 2024/03/06 10:57 a.m.64 views

BIT-AIRFLOW-2022-40604 Format String Vulnerability

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction...

7.5CVSS7.3AI score0.01632EPSS
SaveExploits0References3
OSV
OSV
added 2024/03/06 10:56 a.m.64 views

BIT-MLFLOW-2023-6974 Server-Side Request Forgery (SSRF)

A malicious user could use this issue to access internal HTTPs servers and in the worst case ie: aws instance it could be abuse to get a remote code execution on the victim machine...

9.8CVSS9.4AI score0.01507EPSS
SaveExploits1References3
OSV
OSV
added 2024/03/06 10:55 a.m.64 views

BIT-MASTODON-2023-42452 Mastodon vulnerable to Stored XSS through the translation feature

Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to execu...

6.1CVSS6.1AI score0.00391EPSS
SaveExploits0References3
OSV
OSV
added 2024/03/06 10:51 a.m.64 views

BIT-APISIX-2021-43557 Path traversal in request_uri variable

The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains...

7.5CVSS7.3AI score0.14589EPSS
SaveExploits1References5
OSV
OSV
added 2024/02/26 6:30 p.m.64 views

GHSA-V8VJ-CV27-HJV8 LangChain Experimental vulnerable to arbitrary code execution

langchainexperimental aka LangChain Experimental before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the import, subclasses, builtins, globals, getattribute, bases, mro, or base attribute in Python code. These are not...

9.8CVSS8.9AI score0.00773EPSS
SaveExploits0References3
OSV
OSV
added 2024/02/21 12:4 a.m.64 views

GHSA-3366-9287-7QPR Path disclosure in JavaScript variable

Impact Path disclosure in JavaScript variable Patches Patch in PrestaShop 8.1.4 References https://owasp.org/www-community/attacks/FullPathDisclosure Thanks to https://github.com/hugo-fasone...

5.8CVSS5.2AI score0.00605EPSS
SaveExploits0References5
OSV
OSV
added 2024/01/31 3:17 p.m.64 views

BIT-LIFERAY-2023-42497

Reflected cross-site scripting XSS vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the...

9.6CVSS6.2AI score0.0046EPSS
SaveExploits0References1
OSV
OSV
added 2024/01/29 10:30 p.m.64 views

GHSA-XVQ9-4VPV-227M Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature

Summary The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system...

9.8CVSS9.8AI score0.00699EPSS
SaveExploits0References6
OSV
OSV
added 2024/01/21 6:30 p.m.64 views

GHSA-297X-2QF3-JRJ3 Unsafe yaml deserialization in llama-hub

The OpenAPI and ChatGPT plugin loaders in LlamaHub aka llama-hub before 0.0.67 allow attackers to execute arbitrary code because safeload is not used for YAML...

9.8CVSS9.8AI score0.01192EPSS
SaveExploits0References6
OSV
OSV
added 2024/01/10 9:30 a.m.64 views

GHSA-F899-4MR4-FQPV Apache Answer Race Condition vulnerability

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Answer. This issue affects Apache Answer: through 1.2.0. Under normal circumstances, a user can only bookmark a question once, and will only increase the number of questions bookmarke...

3.1CVSS3.6AI score0.00891EPSS
SaveExploits0References4
OSV
OSV
added 2024/01/10 12:0 a.m.64 views

ALSA-2024:0150 Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1...

9.8CVSS7.7AI score0.02892EPSS
SaveExploits0References8
OSV
OSV
added 2024/01/02 6:32 p.m.64 views

GO-2023-2394 Spoofed source IP address in github.com/shift72/caddy-geo-ip

The caddy-geo-ip aka GeoIP middleware for Caddy 2 allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictions...

6.5CVSS6.3AI score0.00655EPSS
SaveExploits0References2
OSV
OSV
added 2024/01/02 12:0 a.m.64 views

ALSA-2024:0003 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.6.0. Security Fixes: Mozilla: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver CVE-2023-6856 Mozilla: Memory safety bugs fixed in Firefox 121, Firefo...

8.8CVSS8.8AI score0.20472EPSS
SaveExploits0References24
OSV
OSV
added 2023/12/19 11:37 p.m.64 views

GHSA-WQ59-4Q6R-635R Authentication bypass vulnerability in navidrome's subsonic endpoint

Summary A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token JWT signed with the key "not so secret". The vulnerability can only be exploited o...

8.6CVSS8.9AI score0.0069EPSS
SaveExploits1References4
OSV
OSV
added 2023/12/13 3:30 p.m.64 views

GHSA-CWH6-HM53-6W2M Missing access control in Silverpeas

The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users; including those sent only to administrators...

7.5CVSS7.4AI score0.00766EPSS
SaveExploits1References5
OSV
OSV
added 2023/12/05 10:46 p.m.64 views

GHSA-MHHP-C3CM-2R86 Test code in published microsoft-graph-core package exposes phpinfo()

Impact The Microsoft Graph Core PHP SDK published packages which contained test code that enabled the use of the phpInfo function from any application that could access and execute the file at vendor/microsoft/microsoft-graph-core/tests/GetPhpInfo.php. The phpInfo function exposes system...

5.4CVSS7.5AI score0.02203EPSS
SaveExploits0References9
OSV
OSV
added 2023/11/24 4:54 p.m.64 views

GHSA-V4V2-8H88-65QJ Attribute Injection leading to XSS(Cross-Site-Scripting)

Summary Google Analytics element Attribute Injection leading to XSS Details Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. PoC 1. Run the lates...

6.1CVSS6.3AI score0.00497EPSS
SaveExploits1References4
OSV
OSV
added 2023/11/17 6:31 a.m.64 views

GHSA-V32M-PF9Q-P3XG Liferay Portal XSS with `p_l_back_url_title` on edit content page

Reflected cross-site scripting XSS vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the plbackurltitle parameter...

9.6CVSS6.7AI score0.0065EPSS
SaveExploits0References2
OSV
OSV
added 2023/11/15 12:31 a.m.64 views

GHSA-55G2-VM3Q-7W52 Ansible galaxy-importer Path Traversal vulnerability

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten...

6.3CVSS6.4AI score0.00834EPSS
SaveExploits1References8
Total number of security vulnerabilities5000