Sensitive Information Disclosure

TYPO3/flow is vulnerable to information disclosure. The vulnerability is due to timing attacks revealing account existence because password hashing was only performed if an account was found...

Session Data Exposure

TYPO3 is vulnerable to session data exposure. The vulnerability is due to session data of authenticated frontend users being transformed into an anonymous user session during logout, allowing the next user to access previous session data...

Sensitive Information Disclosure

Typo3/Neos is vulnerable to Sensitive Information Disclosure. The vulnerability is due to internal workspaces being accessible without authentication, which was mistakenly assumed to be a feature...

Arbitrary File Upload

typo3/flow is vulnerable to arbitrary file uploads. The vulnerability is due to allowing the upload of server-side scripts, which can be executed if not blocked by other means...

Denial Of Service (DoS)

Directus is vulnerable to Denial Of Service DoS. The vulnerability is due to field duplication in GraphQL, where an attacker can overwhelm the server by requesting the same field multiple times in a single query, leading to excessive resource consumption and denial of service for legitimate users...

Sensitive Information Disclosure

directus is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper error handling when using SSO providers in combination with local authentication. An attacker can determine if an email address belongs to an SSO user by observing the error message provided by...

Cross Site Scripting (XSS)

khoj-assistant is vulnerable to Cross Site Scripting XSS. The vulnerability is due to inadequate sanitization of the AI model's response and user inputs. An attacker can exploit this vulnerability via Prompt Injection from untrusted documents indexed by the user or read from the internet when the...

Improper Access Control

directus is vulnerable to Improper Access Control. The vulnerability is due to improper handling of in and nin operators, which allows an attacker to query expressions with empty arrays, which are evaluated as valid, resulting in unauthorized access...

Cross-Site Scripting (XSS)

org.apache.nifi, nifi-web-ui is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper validation/sanitization for the description field in the Parameter Context configuration, allowing arbitrary JavaScript code to be executed by the client browser within the sessi...

SQL Injection

nhibernate is vulnerable to SQL injection. The vulnerability is due to the lack of proper validation/sanitization of some types implemented from ILiteralType.ObjectToSQLString, allowing attackers to exploit mappings with discriminator values, HQL queries referencing static fields, and the use of...

Denial Of Service (DOS)

OPCFoundation.NetStandard.Opc.Ua.Core is vulnerable to Denial Of Service. The vulnerability is due to improper buffer management when the system receives an excessive number of messages from a remote source, which could allow remote attackers to exhaust memory resources and potentially lead to a...

Cross-Site Scripting (XSS)

railsadmin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improperly-escaped HTML title attributes in the RailsAdmin list view, which can allow attackers to inject malicious scripts. Note: While 3.1.3 is the safe version, its recommended to upgrade to 3.1.4 as the 3.1.3...

Server Side Request Forgery (SSRF)

Apache HTTP Server 2.4.59 is vulnerable to SSRF. The vulnerability is due to a missing validation in response headers leading to information disclosure, SSRF or local script execution via backend applications which have malicious or exploitable header...

NULL Pointer Dereference

modproxy in Apache HTTP Server is vulnerable to NULL Pointer Dereference. The vulnerability is caused due to not checking pointer reference for NULL before accessing it. This allows an attacker to crash the server via a malicious request...

Server-Side Request Forgery (SSRF)

Apache HTTP Server on Windows is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to a missing validation on HTTP requests allowing attackers to potentially leak NTLM hashes to a malicious server...

Authentication Bypass

modproxy in Apache HTTP Server is vulnerable to Authentication Bypass. The vulnerability is caused due to encoding problem. This allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests...

Improper Encoding

Apache HTTP Server is vulnerable to Improper Encoding. The vulnerability is caused due to Substitution encoding issue in modrewrite. This allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to...

Supply Chain Attack

yt-dlp is vulnerable to Supply Chain Attack. The vulnerability is due to the use of a compromised CDN cdn.bootcdn.net which is used to fetch a component of the crypto-js JavaScript library, allowing an attacker to potentially inject and execute malicious JavaScript code...

Server Side Request Forgery (SSRF)

Directus is vulnerable to Server-Side Request Forgery SSRF. This vulnerability is caused by insecure redirects during file imports from external sources due to proper validation of the resulting URL, which can allows an attacker to send crafted requests to internal IP addresses, resulting in SSRF...

Memory Disclosure

Undici is vulnerable to Memory Leakage. The vulnerability is due to the response.arrayBuffer method, which potentially allows an attacker to exposes sensitive portions of memory from Node.js process depending on the network and process conditions...

Denial Of Service (DoS)

aimhubio/aim is vulnerable to Denial Of Service DoS. The vulnerability is due to the remote tracking server being configured to point at itself while using the class method Repo.frompath, which allows an attacker to cause the server to endlessly connect to itself and become unable to respond to...

Cross-Site Request Forgery (CSRF)

mudler/localai is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is caused due to insufficient CSRF protection mechanisms on the model deletion functionality, which allows an attackers o trick victims into deleting installed models...

SQL Injection

vanna-ai/vanna is vulnerable to SQL injection. The vulnerability is due to an exposed SQL query pgreadfile, which allows remote users to read arbitrary local files on the victim server, including sensitive files such as /etc/passwd. Note that this vulnerability is only exploitable due to an...

Denial Of Service (DoS)

github.com/jackc/pgx is vulnerable to Denial Of Service DoS. The vulnerability is due to a lack of robust error handling Pipeline panicking when PgConn PostgreSQL connection is busy or closed, which can result in potential instability and crashes in applications using Pipeline for database...

Incorrect Authorization

Evmos is vulnerable to Incorrect Authorization. The vulnerability is due to allowing users to create a vesting account with a third-party account as the funder, enabling unauthorized fund transfers from the funder address...

Insufficient Verification Of Data Authenticity

certifi is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to its historical inclusion of root certificates from GLOBALTRUST for SSL certificate validation, after which these certificates were removed due to ongoing compliance issues identified during an...

Denial Of Service (DoS)

github.com/rs/cors is vulnerable to Denial of Service DoS. The vulnerability is due to excessive heap allocations when processing malicious preflight requests that include an Access-Control-Request-Headers ACRH header with many commas, which allows attackers can cause undue stress on the...

Server Side Request Forgery (SSRF)

@fedify/fedify is vulnerable to Server Side Request Forgery SSRF. The vulnerability is caused by making HTTP requests to internal IP addresses referenced in received activities or media URLs, which allows an attacker to send requests to resources within the Fedify server's internal network...

Authorization Bypass

github.com/traefik/traefik is vulnerable to Authorization Bypass.The vulnerability is caused due to improper handling of HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses, which allows an attacker to bypass IP allow-lists...

Server-Side Request Forgery

github.com/go-skynet/localai is vulnerable to Server-Side Request Forgery. The vulnerability is due to the /models/apply endpoint supporting both https:// and file:// schemes, which can lead to LFI. The attacker can exploit this vulnerability with network access to the LocalAI instance, potential...

SQL Injection

egroupware/egroupware is vulnerable to Sql Injection. The vulnerability is due to improper handling of the ORDER BY clause in database queries, potentially leading to SQL injection. An attacker can exploit this vulnerability to manipulate database queries, leading to unauthorized data access or...

Cross-site Scripting (XSS)

TYPO3 is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to failing to properly encode information from external sources, which could allow attackers to inject malicious scripts into the Install Tool language pack interface...

Cross-site Scripting (XSS)

TYPO3 CMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to failing to properly encode user input in multiple areas of the CMS, allowing attackers to inject malicious scripts...

Broken Access Control

TYPO3 is vulnerable to Broken Access Control. The vulnerability is due to regular backend users having access to import functionality that is typically restricted to admin users or users with specific User TSconfig settings enabled options.impexp.enableImportForNonAdminUser...

Insecure Deserialization

TYPO3 is vulnerable to Insecure Deserialization. The vulnerability is due to failing to properly validate incoming data in the suggest wizard, which allows an attacker to exploit insecure unserialize operations. A valid backend user account is required to exploit this vulnerability...

Sensitive Information Disclosure

TYPO3 is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the element information component not properly checking the backend user's permissions for the list of references from or to a record...

Session Fixation

TYPO3 is vulnerable to Session Fixation. The vulnerability is due to existing sessions for a user account not being revoked when the user changes their password...

Arbitrary File Deletion

gogs.io/gogs is vulnerable to Arbitrary File Deletion. The vulnerability is due to insufficient access controls, allowing unauthorized users to delete internal files on the host...

Cross Site Scripting (XSS)

zendframework/zend-form is vulnerable to Cross Site Scripting XSS. The vulnerability is due to the use of the escapeHtml helper instead of escapeHtmlAttr, leading to improper escaping of HTML attributes. An attacker can exploit this by injecting malicious code through user data or JavaScript in...

Command Injection

gogs.io/gogs is vulnerable to Command Injection. The vulnerability is caused due to inadequate input validation during the previewing of changes, allowing an attacker to inject arbitrary commands...

Command Injection

gogs.io/gogs is vulnerable to Command Injection. The vulnerability is caused by improper input validation or sanitization during the tagging process of a new release. Attackers can exploit this issue by injecting malicious commands or additional arguments into the tagging command, which may be...

OS Command Execution

HFS is vulnerable to OS Command Execution. The vulnerability is due to using execSync instead of spawnSync in a childprocess to execute the df shell command, which allows an attacker to execute OS commands remotely via the file upload feature...

Remote Code Execution (RCE)

gogs.io/gogs is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of command-line arguments within the bundled ssh implementation internal/ssh/ssh.go. An attacker can exploit the vulnerability by sending a malicious --split-string env request through an SSH...

Command Injection

deeplake is vulnerable to Command Injection. The vulnerability is due to a lack of input sanitization within the ingestkaggle API when ingesting a remote Kaggle dataset, allowing an attacker to execute arbitrary commands on the server...

NULL Pointer Dereference

libzephyr.so is vulnerable to NULL Pointer Dereference. The vulnerability is due to a malicious BLE device sending a specific order of packet sequences to cause a DoS attack on the victim BLE device...

Improper Access Control

Mattermost is vulnerable to Improper Access Control. The vulnerability is due to a failure to prevent specifying a RemoteId when creating a new user, allowing attackers to create a user with a user-defined ID, which can cause broken functionality in User Management...

Parameter Injection

zend-mail is vulnerable to Parameter Injection. The vulnerability is due to unsanitized additional quote characters within an address in the file Sendmail.php, which allows an attacker to inject arbitrary parameters to the system sendmail program...

Denial Of Service (DoS)

org.apache.tomcat: tomcat-coyote is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of excessive HTTP headers in HTTP/2 streams, which leads to the miscounting of active streams resulting in an infinite connection timeout. This allows connections to remain open...

URL Rewrite

zendframework/zendframework is vulnerable to URL Rewrite. The vulnerability is due to the request URI marshaling logic that introspects HTTP request headers specific to server-side URL rewrite mechanisms. When these headers are present on systems not running the specific URL rewriting mechanism,...

Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Information Disclosure. The vulnerability is due to a failure to properly sanitize the recipients of a webhook event, allowing attackers monitoring webhook events to retrieve the channel IDs of archived or restored channels...