36927 matches found
GHSA-23R4-5MXP-C7G5 parse-server new anonymous user session acts as if it's created with password
Impact Developers that use the REST API to signup users and also allow users to login anonymously. When an anonymous user is first signed up using REST, the server creates session incorrectly, particularly the authProvider field in Session class under createdWith shows the user logged in creating...
GHSA-J239-4GQG-5J54 Inadequate Encryption Strength
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution...
GHSA-C332-W4JM-55WV Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 Vaadin versions 8.0.0 through 8.12.4 allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses...
GHSA-77PW-C3J2-5FC8 Plaintext password leak in Apache Superset
In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the...
GHSA-C4QR-GMR9-V23W Prefix escape
Impact By crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is /pub/, a user expect that accessing /priv on the target service would not be possible. Unfortunately, it is. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N...
GHSA-P4PJ-9G59-4PPV Remote Code Execution in SyliusResourceBundle
Impact Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. The vulnerable versions...
GHSA-H4MF-75HF-67W4 Information disclosure in parse-server
you can fetch all the users' objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken "SessionToken":"$regex":"r:027f" and find valid accounts this way. Using this method, it's possible to retrieve accounts without interaction from the users. GET...
GHSA-W69W-JVC7-WJGV Undertow Missing Authorization when requesting a protected directory without trailing slash
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...
GHSA-73RF-6MRF-759Q devise Time-of-check Time-of-use Race Condition vulnerability
Devise ruby gem before 4.6.0 when the lockable module is used is vulnerable to a time-of-check time-of-use TOCTOU race condition due to incrementfailedattempts within the Devise::Models::Lockable class not being concurrency safe...
GHSA-J5RJ-G695-342R Fat Free CRM vulnerable to Cross-site Scripting
FatFreeCRM version =0.15.0 =0.16.0 =0.17.0 =0.17.2, and ==0.18.0 contains a Cross Site Scripting XSS vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed...
GHSA-5726-G6R9-5F22 Potential for Script Injection in syntax-error
Versions of syntax-error prior to 1.1.1 are affected by a cross-site scripting vulnerability which may allow a malicious file to execute code when browserified. Recommendation Update to version 1.1.1 or later...
GHSA-57Q6-FVP4-PQMM Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
Summary Open WebUI allows admins to restrict which API endpoints an API key can access. When an API key is restricted from /api/v1/messages, requests using the Authorization: Bearer sk-... header are correctly blocked with 403. However, the same key sent via the x-api-key header bypasses the...
GHSA-3F29-PQWF-V4J4 Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass
Summary Information disclosure exists in Grav CMS v1.8.0-beta.29. Despite previous security patches notably in v1.8.0-beta.27/28 aimed at restricting sensitive object access within the Twig environment, the Accounts Service remains exposed. A low-privileged user EX: Content Editor with only...
GHSA-MC43-4FQR-C965 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
Summary An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. Attacker can abuse this to scan internal networks and gain information about them then exploit further. Moreover,...
GHSA-4H9W-7VFP-PX8M Shopware default newsletter opt-in settings allow for mass sign-up abuse
Impact Currently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are: Newsletter: Double Opt-in - active Newsletter: Double opt-in for registered customers - disabled Log-in & sign-up: Double opt-in on sign-up - disabled...
GHSA-3W85-5P9G-H334 Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type
A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When...
GHSA-CJ47-QJ6G-X7R4 vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer RPC server entrypoints. The core functionality runserverloop calls the function makehandlercoro, which directly uses cloudpickle.loads on received messages without any sanitization. This can result in remote code...
GHSA-8M8M-98C9-VW7Q Duplicate Advisory: pimcore/customer-data-framework vulnerable to SQL Injection: Hibernate
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q53r-9hh9-w277. This link is maintained to preserve external references. Original Description A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0...
GHSA-J945-C44V-97G6 MPXJ has a Potential Path Traversal Vulnerability
Impact The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. Patches The issue is addressed i...
GHSA-C479-WQ8G-57HR Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
Impact When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers including ones officially documented for use with Pterodactyl will log query...
GHSA-FP6Q-GCCW-7QQM Umbraco CMS logout page displayed before session expiration
Impact The Backoffice displays the logout page with a session timeout message before the server session has fully expired, causing users to believe they have been logged out approximately 30 seconds before they actually are...
GHSA-4GP9-FF99-J6VJ Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
Impact An improper access control issue has been identified, allowing low-privilege users to access the webhook API and retrieve information that should be restricted to users with access to the settings section...
GHSA-593M-55HH-J8GV Sentry SDK Prototype Pollution gadget in JavaScript SDKs
Impact In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue. !NOTE This...
GHSA-3X3F-JCP3-G22J @backstage/plugin-catalog-backend Prototype Pollution vulnerability
Impact A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. Patches This has been fixed in the 1.26.0 release of the @backstage/plugin-catalog-backend...
GHSA-X6XQ-WHH3-GG32 Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies
Impact Instances of the Apollo Router using either of the following may be impacted by a denial-of-service vulnerability. 1. External Coprocessing with specific configurations; or 2. Native Rust Plugins accessing the Router request body in the RouterService layer Router customizations using Rhai...
GHSA-5263-PM2H-M7HW Mattermost doesn't restrict which roles can promote a user as system admin
Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0 and 9.8.x = 9.8.2 fail to restrict which roles can promote a user as system admin which allows a System Role with edit access to the permissions section of system console to update their role e.g. member to include the managesystem...
GHSA-WHPX-G542-7C7V @cat5th/key-serializer Prototype Pollution vulnerability
harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties...
GHSA-64JQ-M7RQ-768H Rancher's External RoleTemplates can lead to privilege escalation
Impact A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation. The bug in the webhook rule resolver ignores rules from a ClusterRole for external...
GHSA-68X5-4JG5-GJGG Moodle CSRF risk in analytics management of models
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...
GHSA-99JC-WQMR-FF2Q MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. Impact Disclosure of the followi...
GHSA-MRJ3-F2H4-7W45 Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method
Summary Using Pickup: Local stock only as a click-and-collect points could cause a leak of customer addresses Details When using Pickup: Local stock only click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes it...
GHSA-J6VV-VV26-RH7C HashiCorp Vault Improper Privilege Management
HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4...
GHSA-437M-7HJ5-9MPW Kruise allows leveraging the kruise-daemon pod to list all secrets in the entire cluster
Impact Attacker that has gain root privilege of the node that kruise-daemon run , can leverage the kruise-daemon pod to list all secrets in the entire cluster. After that, attackers can leverage the "captured" secrets e.g. the kruise-manager service account token to gain extra privilege such as p...
GHSA-P5F8-QF24-24CJ Velocity execution without script right through tree macro
Impact It's possible to execute a Velocity script without script right through the document tree. To reproduce: As a user without script right, create a document, e.g., named Nasty Title Set the document's title to $request.requestURI Click "Save & View" Reload the page in the browser The...
GHSA-PWFR-8PQ7-X9QV Unauthenticated Denial of Service in the octokit/webhooks library
Impact Versions v9.26.0, v10.9.x, v11.1.x, v12.0.x all contained the code that would throw the error. Specifically, during a pentest we encountered a bug in the octokit/webhooks library a dependency of Probot, a framework for building Github Apps. The resulting request was found to cause an...
GHSA-7654-VFH6-RW6X Remote code execution from account through SearchAdmin
Impact The search administration interface doesn't properly escape the id and label of search user interface extensions, allowing the injection of XWiki syntax containing script macros including Groovy macros that allow remote code execution, impacting the confidentiality, integrity and...
GHSA-5R33-MGJF-6656 Jenkins Tuleap Authentication Plugin non-constant time token comparison
Jenkins Tuleap Authentication Plugin 1.1.20 and earlier does not use a constant-time comparison when checking whether two authentication tokens are equal. This could potentially allow attackers to use statistical methods to obtain a valid authentication token. Tuleap Authentication Plugin 1.1.21...
GHSA-57FC-8Q82-GFP3 langchain vulnerable to arbitrary code execution
An issue in langchain allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method...
GHSA-C2PJ-V37R-2P6H Coraza has potential denial of service vulnerability
Summary Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. Details https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.goL26-L29 The bodyprocessors of multipart uses...
GHSA-MPV3-G8M3-3FJC Grafana vulnerable to Authentication Bypass by Spoofing
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app...
GHSA-W6F8-MXF5-4VF8 Missing authorization in Liferay portal
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL...
GHSA-HH7J-PG39-Q563 toui allows user-specific variables to be shared between users
Impact Websites that use Website.uservars property in versions. Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1 Workarounds Do not use Website.uservars in websites when using versions v2.0.1 to v2.4.0. Also, do not use Website.signinuser in version v2.4.0 only. Explanation...
GHSA-W3F6-PC54-GFW7 swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. It is fixed in 1.19.2 and later releases. There are a number of...
GHSA-7V2V-9RM4-7M8F Shopware Has Improper Control of Generation of Code in Twig rendered views
Impact We fixed with CVE-2023-22731 Twig filters to only be executed with allowed functions. It is possible to pass PHP Closures as string or an array and array crafted PHP Closures was not checked against allow list Patches The problem has been fixed with 6.4.20.1 with an improved override...
GHSA-JC97-H3H9-7XH6 Regular Expression Denial of Service in Deno.upgradeWebSocket API
Impact Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service ReDoS due to the upgradeWebSocket function, which contains regexes in the form of /s,s/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be...
GHSA-W4G6-8XQP-G92M Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks
Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control coverage report file contents for the Post to Phabricator post-build action to have Jenkins parse a crafted XML document th...
GHSA-VPX4-7RFP-H545 Unprivileged XWiki Platform users can make arbitrary select queries using DatabaseListProperty and suggest.vm
Impact Any user with edit right can execute arbitrary database select and access data stored in the database. To reproduce: In admin, rights, remove scripting rights for XWikiAllGroup. Create a new user without any special privileges. Create a page "Private.WebHome" with TOKEN42 as content. Go to...
GHSA-87MM-QXM5-CP3F go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs
go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a...
GHSA-JGC8-GVCX-9VFX XWiki Platform Improper Authorization check for inactive users
Impact Some resources are missing a check for inactive not yet activated or disabled users in XWiki, including the REST service: so a disabled user can enable themselves using a REST call. On the same way some resources handler created by extensions are not protected by default: so an inactive...