36904 matches found
GHSA-8W87-58W6-HFV8 Rancher doesn't properly sanitize credentials in cluster template answers
Impact It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3 there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords and API tokens. The exposed credentials are...
GHSA-6Q7M-P8CC-998R Mattermost has a Missing Authorization vulnerability
Mattermost versions 10.11.x = 10.11.1, 10.10.x = 10.10.2, 10.5.x = 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state...
GHSA-GGJM-F3G4-RWMM n8n symlink traversal vulnerability in "Read/Write File" node allows access to restricted files
Impact A symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links symlinks. An attacker with the ability to create symlinks—such as by using the...
GHSA-8FM5-GG2F-F66Q Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction
Summary A publisher on a publify application is able to perform a cross-site scripting attack on an administrator using the redirect functionality. Details A publisher on a publify application is able to perform a cross-site scripting attack on an administrator using the redirect functionality. T...
GHSA-4F2V-2GPQ-QHJG GetmeUK ContentTools Cross-Site Scripting (XSS)
A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation of the argument onload leads to cross site scripting. The attack may be launched remotely. The...
GHSA-M5MF-3963-4X26 Authelia applies regulation separately to Username-based logins to Email-based logins
Summary If users are allowed to sign in via both username and email the regulation system treats these as separate login events. This leads to the regulation limitations being effectively doubled assuming an attacker using brute-force to find a user password. It's important to note that due to th...
GHSA-9CRC-Q9X8-HGQQ Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Summary Arbitrary remote Code Execution when accessing a malicious website while Vitest API server is listening by Cross-site WebSocket hijacking CSWSH attacks. Details When api option is enabled Vitest UI enables it, Vitest starts a WebSocket server. This WebSocket server did not check Origin...
GHSA-MQF3-QPC3-G26Q Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
!IMPORTANT This vulnerability only affects sites which are in the "dev" environment mode. If your production website is in "dev" mode, it has been misconfigured, and you should immediately swap it to "live" mode. See https://docs.silverstripe.org/en/developerguides/debugging/environmenttypes/ for...
GHSA-F697-GM3H-XRF9 Apache HugeGraph-Server: Fixed JWT Token (Secret)
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue...
GHSA-4P75-5P53-65M9 Contao affected by directory traversal in the file selector widget
Impact Back end users can list files outside their file mounts or the document root in the FileSelector widget. Patches Update to Contao 4.13.49. Workarounds None. References https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget For more information If you have...
GHSA-QWGC-RR35-H4X9 External Secrets Operator vulnerable to privilege escalation
Details The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "get/list" verbs of secrets...
GHSA-6247-7862-Q2PQ Apache Helix Front (UI) component contained a hard-coded secret
The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are...
GHSA-3R74-V83P-F4F4 Trufflehog vulnerable to Blind SSRF in some Detectors
Impact What kind of vulnerability is it? Who is impacted? This vulnerability allows a malicious actor to craft data in a way that, when scanned by specific detectors, could trigger the detector to make an unauthorized request to an endpoint chosen by the attacker. For an exploit to be effective,...
GHSA-W6J6-W6JX-VF2R Concrete CMS Stored XSS in getAttributeSetName
Concrete CMS versions 9 through 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in getAttributeSetName. A rogue administrator could inject malicious code...
GHSA-92VC-4FCW-G68Q CasaOS Command Injection vulnerability
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue...
GHSA-2JCH-QC96-9F5G Flowise Cross-site Scripting in api/v1/chatflows/id
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the api/v1/chatflows/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to craft a...
GHSA-Q22Q-2RRF-M27P Mattermost allows unsolicited invites to expose access to local channels
Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local...
GHSA-WF3X-JCCF-5G5G XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader
Impact When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the victim into uploading a file with a malicious name. The malicious code is solely executed during the upload and affects only the user...
GHSA-Q9W2-H4CW-8GHP Apache RocketMQ Vulnerable to Unauthorized Exposure of Sensitive Data
For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist...
GHSA-HCF8-5J78-887V Apache StreamPark: Information leakage vulnerability
In Streampark version 2.1.4, when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credential. User can use this credential to request other users' information, including the administrator's username, password, salt value, etc. ...
GHSA-7Q3H-J95Q-3VJH Arbitrary File Creation in opencart
This affects versions of the package opencart/opencart from 4.0.0.0. An Arbitrary File Creation issue was identified via the database restoration functionality. By injecting PHP code into the database, an attacker with admin privileges can create a backup file with an arbitrary filename including...
GHSA-HPCG-XJQ5-G666 Minder affected by denial of service from maliciously configured Git repository
Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users repositories using the github.com/go-git/go-git/v5 library on these lines:...
GHSA-X268-QPG6-W9G2 CrateDB has a Client initialized Session-Renegotiation DoS
Summary Client-Initiated TLS Renegotiation Denial of Service DoS Vulnerability at Port 4200 Details A high-risk vulnerability has been identified where the TLS endpoint port 4200 permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly request...
GHSA-6FQW-J3VM-7F66 Zendframework1 Potential SQL injection in ORDER and GROUP functions
The implementation of ORDER BY and GROUP BY in ZendDbSelect remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensur...
GHSA-W5MJ-J45Q-M638 ZendFramework1 Potential Security Issues in Bundled Dojo Library
In mid-March, 2010, the Dojo Foundation issued a Security Advisory indicating potential security issues with specific files in Dojo Toolkit. Details of the advisory may be found on the Dojo website: http://dojotoolkit.org/blog/post/dylan/2010/03/dojo-security-advisory/ In particular, several file...
GHSA-Q25C-C977-4CMH Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever
A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet...
GHSA-632P-P495-25M5 Directus is soft-locked by providing a string value to random string util
Describe the Bug Providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be refreshed as sessions...
GHSA-VW63-824V-QF2J SQL Injection in Harbor scan log API
Impact A user with an administrator, projectadmin, or projectmaintainer role could utilize and exploit SQL Injection to allow the execution of any Postgres function or the extraction of sensitive information from the database through this API: GET...
GHSA-PMRX-695R-4349 dbt allows Binding to an Unrestricted IP Address via socketsocket
Summary Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the risk of unauthorized access. While doing some static analysis and code inspection, I found the following code binding a socket to INADDRANY by passing "" as the address. This...
GHSA-J6CV-98JX-MRWR Mocodo vulnerable to SQL injection in `/web/generate.php`
Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sqlcase input field in /web/generate.php, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution RCE under certain conditions...
GHSA-6362-GV4M-53WW Calico privilege escalation vulnerability
In vulnerable versions of Calico v3.27.2 and below, Calico Enterprise v3.19.0-1, v3.18.1, v3.17.3 and below, and Calico Cloud v19.2.0 and below, an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. T...
GHSA-7J7J-66CV-M239 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass
Impact ZITADEL provides users the possibility to use Time-based One-Time-Password TOTP and One-Time-Password OTP through SMS and Email. While ZITADEL already gives administrators the option to define a Lockout Policy with a maximum amount of failed password check attempts, there was no such...
GHSA-86FC-F9GR-V533 HTTP Handling Vulnerability in the Bare server
Impact This vulnerability relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially...
GHSA-RC6H-QWJ9-2C53 Apache DolphinScheduler vulnerable to arbitrary JavaScript execution as root for authenticated users
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This...
GHSA-59QJ-JCJV-662J DIRAC's TokenManager does not check permissions on cached tokens
Impact Any user could get a token that has been requested by another user/agent Patches The vulnerability is fixed in version 8.0.37. Workarounds None References...
GHSA-7QW4-9R68-2RMX mingSoft MCMS File Upload vulnerability
File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do...
GHSA-F56G-CHQP-22M9 Use after free in libpulse-binding
Overview Version 2.5.0 of the libpulse-binding Rust crate, released on the 22nd of December 2018, fixed a potential use-after-free issue with property list iteration due to a lack of a lifetime constraint tying the lifetime of a proplist::Iterator to the Proplist object for which it was created...
GHSA-Q6W5-JG5Q-47VG @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Impact Unauthorized access or privilege escalation due to a logic flaw in auth in the App Router or getAuth in the Pages Router. Affected Versions All applications that that use @clerk/nextjs versions in the range of = 4.7.0, 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or...
GHSA-8QW9-GF7W-42X5 Minor fix to previous patch for CVE-2022-35918
Impact The initial vulnerability identified in Streamlit apps using custom components, allowing for directory traversal attacks, was addressed in version 1.11.1. However, a minor issue persisted, which could still potentially expose certain files on the server file-system under specific condition...
GHSA-F899-4MR4-FQPV Apache Answer Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Answer. This issue affects Apache Answer: through 1.2.0. Under normal circumstances, a user can only bookmark a question once, and will only increase the number of questions bookmarke...
GHSA-93P6-9CXV-5RPQ juzawebCMS Incorrect Access Control vulnerability
juzaweb = 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated...
GHSA-4J8W-P6HV-3QXC Cross-Site Request Forgery (CSRF) in automad/automad
automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery CSRF. An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly...
GHSA-GC3J-VVWF-4RP8 Resque vulnerable to reflected XSS in resque-web failed and queues lists
Impact The following paths in resque-web have been found to be vulnerable to reflected XSS: /failed/?class=alertdocument.cookie /queues/ Patches v2.2.1 Workarounds No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until y...
GHSA-W3VP-JW9M-F9PM Unbounded queuing of path validation messages in cloudflare-quiche
Impact quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation RFC 9000 Section 8.2 requires that the recipient of a PATHCHALLENGE frame responds by sending a...
GHSA-6MJG-37CP-42X5 Improper Privilege Management in sap-xssec
Impact SAP BTP Security Services Integration Library Python sap-xssec allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Patches Upgrade to patched version = 4.1.0 We always...
GHSA-5MMW-P5QV-W3X5 Always incorrect control flow in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...
GHSA-QXRJ-HX23-XP82 Overly permissive origin policy
Currently, the middleware operates in a way that if an allowed origin is not provided, it will return an Access-Control-Allow-Origin header with the value of the origin from the request. This behavior completely disables one of the most crucial elements of browsers - the Same Origin Policy SOP,...
GHSA-5XQM-HC45-F2G2 APM Java Agent Local Privilege Escalation issue
A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious plugin to an application running the APM Java agent. By using this vulnerability, an attacker could execute code at a potentially higher level of permissions than their user...
GHSA-8JPR-FF92-HPF9 Run Shell Command allows Cross-Site Request Forgery
Impact A cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the...