SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the labels host-listing endpoint. An attacker can extract sensitive enrollment secrets by manipulating the sort order and leveraging a cursor-based binary search oracle. This is only exploitab...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the labels host-listing endpoint. An attacker can extract sensitive enrollment secrets by manipulating the sort order and leveraging a cursor-based binary search oracle. This is only exploitab...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the labels host-listing endpoint. An attacker can extract sensitive enrollment secrets by manipulating the sort order and leveraging a cursor-based binary search oracle. This is only exploitab...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the labels host-listing endpoint. An attacker can extract sensitive enrollment secrets by manipulating the sort order and leveraging a cursor-based binary search oracle. This is only exploitab...

Improper Encoding or Escaping of Output

Overview fabric is an Object model for HTML5 canvas, and SVG-to-canvas parser. Backed by jsdom and node-canvas. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the toSVG and getSvgStyles/getSvgSpanStyles paths in the gradient, object, and text SVG...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:fabric is an Object model for HTML5 canvas, and SVG-to-canvas parser. Backed by jsdom and node-canvas. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the toSVG and getSvgStyles/getSvgSpanStyles paths in the gradient, object...

Cross-site Scripting (XSS)

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the FilesController.createFile and FilesRouter file-extension handling in the file upload...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the handleLogIn and verifyPassword user...

Missing Authorization

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Missing Authorization in the draft autosave process. An attacker can overwrite another user's draft by sending an...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the multiPartHeader function when untrusted input is provided via field or filename to FormDataappend. An attacker can inject additional headers or multipart parts by including carriage returns, line feeds, or double...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the multiPartHeader function when untrusted input is provided via field or filename to FormDataappend. An attacker can inject additional headers or multipart parts by including carriage returns, line feeds, or double...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via several endpoints. An attacker can access arbitrary files on the server by sending specially crafted requests containing directory traversal sequences. Details A Directory Traversal attack also known as path...

Incorrect Authorization

Overview @actual-app/sync-server is an actual syncing server Affected versions of this package are vulnerable to Incorrect Authorization through the /openid/config endpoint, which exposes sensitive OpenID Connect configuration data, including the OAuth2 clientsecret, to any caller who knows the...

Arbitrary Code Injection

Overview desktop-electron is a My Electron application description Affected versions of this package are vulnerable to Arbitrary Code Injection via the ELECTRONRUNASNODE environment variable. An attacker can execute arbitrary code with the application's entitlements and code signature by launchin...

Server-side Request Forgery (SSRF)

Overview phanan/koel is a personal audio streaming service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the url field in the radio station creation process. An attacker can induce the server to make arbitrary HTTP requests to internal hosts by supplyin...

Incorrect Authorization

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Incorrect Authorization through the handleBatch request dispatcher in the batch request handling code. An attacker can reach...

Authorization Bypass Through User-Controlled Key

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the reduceRelationKeys and authorizeRelatedToQuery paths in...

Resources Downloaded over Insecure Protocol

Overview org.webjars.npm:esbuild is an An extremely fast JavaScript and CSS bundler and minifier. Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol in the installFromNPM process. An attacker can execute arbitrary code with the privileges of the Deno...

Resources Downloaded over Insecure Protocol

Overview esbuild is an An extremely fast JavaScript and CSS bundler and minifier. Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol in the installFromNPM process. An attacker can execute arbitrary code with the privileges of the Deno process by...

Directory Traversal

Overview esbuild is an An extremely fast JavaScript and CSS bundler and minifier. Affected versions of this package are vulnerable to Directory Traversal in the servedir process on Windows systems due to improper path normalization. An attacker can access arbitrary files outside the intended...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the deserialization process of user-controlled data from the radapp.io/status annotation on a Kubernetes Deployment. An attacker can cause deletion of container resources belonging t...

Missing Authorization

Overview typo3/cms-form is a Form Library, Plugin and Editor Affected versions of this package are vulnerable to Missing Authorization in the processing of form definition files by the Form Framework. An attacker can gain administrative privileges by uploading and using maliciously crafted files...

Missing Authorization

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Missing Authorization in the Recycler module. An attacker can restore soft-deleted records on pages or tables they are not authorized to modify by accessing the...

Open Redirect

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Open Redirect via the GeneralUtility::sanitizeLocalUrl function. An attacker can redirect users to external sites by crafting a URL that passes the sanitization...

Missing Authorization

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Missing Authorization due to missing authorization checks when handling file mount folders. An attacker can perform unauthorized write operations, such as moving...

Missing Authorization

Overview typo3/cms-form is a Form Library, Plugin and Editor Affected versions of this package are vulnerable to Missing Authorization via the DataHandler. An attacker can execute unauthorized database queries and gain elevated privileges by directly manipulating form definition records, bypassin...

Missing Authorization

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Missing Authorization via the DataHandler file. An attacker can move records to a different page without having edit permissions on the source page by sending...

Missing Authorization

Overview typo3/cms-form is a Form Library, Plugin and Editor Affected versions of this package are vulnerable to Missing Authorization via the upload for form definition files with mixed-case extensions. An attacker can escalate privileges by uploading maliciously crafted files that execute...

Missing Authorization

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Missing Authorization via the upload for form definition files with mixed-case extensions. An attacker can escalate privileges by uploading maliciously crafted...

Directory Traversal

Overview typo3/cms-filelist is a TYPO3 backend module FileFilelist used for managing files. Affected versions of this package are vulnerable to Directory Traversal via the Media Module when backend users with file download permissions access the fallback storage of the file abstraction layer. An...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the VariableFrontend or Registry. An attacker can execute arbitrary PHP code by injecting a crafted serialized payload into the underlying storage backend, such as the cache store or sysregistry...

Deserialization of Untrusted Data

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the VariableFrontend or Registry. An attacker can execute arbitrary PHP code by injecting a crafted serialized payload into...

Deserialization of Untrusted Data

Overview typo3/cms-extbase is a TYPO3 CMS Extbase - Extension framework to create TYPO3 frontend plugins and TYPO3 backend modules. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the VariableFrontend or Registry. An attacker can execute arbitrary PHP cod...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the VariableFrontend or Registry. An attacker can execute arbitrary PHP code by injecting a crafted serialized payload into the underlying storage backend, such as the cache store or sysregistry...

Deserialization of Untrusted Data

Overview typo3/cms-install is a TYPO3 extension install. The Install Tool is used for installation, upgrade, system administration and setup tasks. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the VariableFrontend or Registry. An attacker can execute...

Deserialization of Untrusted Data

Overview typo3/cms-form is a Form Library, Plugin and Editor Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the VariableFrontend or Registry. An attacker can execute arbitrary PHP code by injecting a crafted serialized payload into the underlying storage...

Directory Traversal

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Directory Traversal via the GeneralUtility::isAllowedAbsPath function. An attacker can access files outside the intended project root by creating new file storag...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Backend API routes. An attacker can access unauthorized file metadata by sending crafted requests to endpoints without proper permission checks, potentially retrieving information about files outside their...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the clipboard. An attacker can access unauthorized records and files by inserting arbitrary entries into the clipboard without proper permission checks. Remediation Upgrade typo3/cms-backend to version 13.4.31,...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via rendering page titles in frontend search results without proper output encoding. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious HTML markup into page...

Buffer Over-read

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Buffer Over-read via the websocketmask function in the speedups component. An attacker can trigger a read past the end of the mas...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...