Buffer Over-read

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Buffer Over-read via the websocketmask function in the speedups component. An attacker can trigger a read past the end of the mas...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition through unsynchronized concurrent access to the InMemorySecret2FA map. An attacker can cause the process to crash by sending multiple simultaneous HTTP requests that trigger concurrent reads and writes to the shared map...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition through unsynchronized concurrent access to the InMemorySecret2FA map. An attacker can cause the process to crash by sending multiple simultaneous HTTP requests that trigger concurrent reads and writes to the shared map...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition through unsynchronized concurrent access to the InMemorySecret2FA map. An attacker can cause the process to crash by sending multiple simultaneous HTTP requests that trigger concurrent reads and writes to the shared map...

Incorrect Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization in the mergeConfigs process. An attacker can obtain sensitive REST datasource authentication credentials by modifying the config.url to redirect requests to an...

Missing Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Missing Authorization via the buildSchema controller. An attacker can modify schema metadata and automation trigger output schema by sending unauthenticated requests to the affected endpoint,...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the /api/public/v1/roles/assign endpoint, which fails to properly restrict assignment of global privileges. An...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the host parameter in the VectorDB configuration process. An attacker can enumerate internal network services and access sensitive internal endpoints by...

Cross-site Request Forgery (CSRF)

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the buildMatcherRegex and matches functions. An attacker can perform unauthorized state-changing actions on behalf...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via mysqlrealescapestring when used with the text protocol and the Big5 character set. An attacker can execute arbitrary SQL queries by supplying specially crafted input that bypasses escaping performed by...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the roleupdated websocket event broadcast process. An attacker can gain unauthorized access to permission scheme change notifications for private teams by connecting to the websocket as an authenticated user wit...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the roleupdated websocket event broadcast process. An attacker can gain unauthorized access to permission scheme change notifications for private teams by connecting to the websocket as an authenticated user wit...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the roleupdated websocket event broadcast process. An attacker can gain unauthorized access to permission scheme change notifications for private teams by connecting to the websocket as an authenticated user wit...

Information Exposure

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Information Exposure via the roleupdated websocket event broadcast process. An attacker can gain unauthorized access to permission scheme change...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the roleupdated websocket event broadcast process. An attacker can gain unauthorized access to permission scheme change notifications for private teams by connecting to the websocket as an authenticated user wit...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the roleupdated websocket event broadcast process. An attacker can gain unauthorized access to permission scheme change notifications for private teams by connecting to the websocket as an authenticated user wit...

Directory Traversal

Overview kedro is a Kedro helps you build production-ready data and analytics pipelines Affected versions of this package are vulnerable to Directory Traversal via the getversionedpath function and the CLI --load-versions parameter, which interpolate user-supplied version strings into filesystem...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Incorrect Authorization in the role patch API. An attacker can gain elevated privileges by...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the role patch API. An attacker can gain elevated privileges by modifying permissions of built-in roles through authenticated requests with delegated user-management permissions. Remediation Upgrade...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the FileInfo.Name field during federation sync. An attacker can overwrite or create files in arbitrary locations within the server's filestore by sending specially crafted filenames containing path traversal...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the FileInfo.Name field during federation sync. An attacker can overwrite or create files in arbitrary locations within the server's filestore by sending specially crafted filenames containing path traversal...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the FileInfo.Name field during federation sync. An attacker can overwrite or create files in arbitrary locations within the server's filestore by sending specially crafted filenames containing path traversal...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the FileInfo.Name field during federation sync. An attacker can overwrite or create files in arbitrary locations within the server's filestore by sending specially crafted filenames containing path traversal...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the FileInfo.Name field during federation sync. An attacker can overwrite or create files in arbitrary locations within the server's filestore by sending specially crafted filenames containing path traversal...

Directory Traversal

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Directory Traversal in the FileInfo.Name field during federation sync. An attacker can overwrite or create files in arbitrary locations within the...

Missing Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Missing Authorization in the team creation process. An attacker can configure unauthorized...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the team creation process. An attacker can configure unauthorized team settings, such as enabling open invites or restricting allowed domains, by sending crafted requests to the relevant API endpoint. Remediatio...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the bot registration process. An attacker can intercept private messages sent by plugins by pre-registering a user account with a predictable bot username. Remediation Upgrade...

Information Exposure

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Information Exposure via the bot registration process. An attacker can intercept private messages sent by plugins by pre-registering a user accoun...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the schemeadmin flag in group syncable link and patch endpoints. An attacker can gain unauthorized administrative privileges by sending crafted API requests. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the schemeadmin flag in group syncable link and patch endpoints. An attacker can gain unauthorized administrative privileges by sending crafted API requests. Remediation Upgrade...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the Remote Cluster PATCH API response due to insufficient sanitization of sensitive information. An attacker can access authentication tokens by sending a PATCH request to the remote...

Insertion of Sensitive Information Into Sent Data

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the Remote Cluster PATCH API response...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the HttpOperation::WriteMemoryCallback. An attacker can cause memory exhaustion by sending a large or unbounded HTTP response when the configured collector endpoint is attacker-controlled ...

Incorrect Authorization

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Incorrect Authorization due to improper evaluation of permissions in the SimpleRBACAuthorizationProvider function. An attacker can gain unauthorized access to resources across different tenants by exploiting the la...

Authorization Bypass Through User-Controlled Key

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to insufficient authorization checks when UUID is provided. An attacker can gain unauthorized access to read, write, update, or delete data belonging to other...

Authorization Bypass Through User-Controlled Key

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the V1 collection-level endpoints passing None for tenant and database to the authorization layer. An attacker can gain unauthorized access to resources by...

Arbitrary Code Injection

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Arbitrary Code Injection in the api/v2/tenants/defaulttenant/databases/defaultdatabase/collections/collectionid endpoint when a malicious model repository is sent and trustremotecode is set to true. An attacker can...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in HttpObjectDecoder.java, which skips whitespace as well as bytes...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in RedisArrayAggregator. An attacker who sends a small RESP array header declaring a very large element count can force the aggregator to reserve a large ArrayList via the...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness in the form of generating stateless reset-tokens based on HMAC connection ID. An attacker in a MitM position can deduce token material by observing QUIC headers after a source CID rotation, and can cause service...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in shouldWaitForDynamicTableUpdates in QpackDecoder. An attacker can open an indefinite number of persistently blocked streams by sending headers that reference dynamic table entries...