Prototype Pollution

@abip/sp-common is vulnerable to Prototype Pollution. The vulnerability is due to the function mergeDeep, which allows attackers to inject arbitrary properties. The attacker can execute arbitrary code or cause a Denial of Service DoS as a result...

Prototype Pollution

@airvertco/frappejs is vulnerable to Prototype Pollution. The vulnerability is due to passing the function registerView with an argument containing a special property proto to pollute the object, which allows attackers to alter the behavior of all objects inheriting from the affected prototype...

Prototype Pollution

@amoy/common is vulnerable to Prototype Pollution. The vulnerability is due to functions like extend and setValue, which can be exploited by passing crafted arguments with a proto property. This allows attackers to alter the behavior of all objects inheriting from the affected prototype...

Denial Of Service (DoS)

github.com/gorilla/schema is vulnerable to Denial of Service DoS. The vulnerability is caused due to unrestricted memory allocation triggered by manipulating the slice index idx beyond the configured maxSize. This allows an attacker to exhaust system resources and potentially crash the applicatio...

Prototype Pollution

@jsonic/jsonic-next is vulnerable to Prototype Pollution. The vulnerability is due to several functions including empty, util.clone, util.prop, util.deep, and make, which can be exploited by passing crafted arguments with the proto property. This allows attackers to alter the behavior of all...

Path Traversal

Weblate is vulnerable to Path Traversal. The vulnerability is caused due to a lack of proper normalization and validation of filenames when restoring project backups. This could allow an attacker to use a crafted ZIP file containing arbitrary paths to gain unauthorized access to files on the serv...

Code Injection

Gradio is vulnerable to Code Injection. The vulnerability is caused due to improper input validation in the gradio/componentmeta.py. This flaw allows an attacker to execute arbitrary code via a crafted input...

Improper Access Control

github.com/goauthentik/authentik is vulnerable to Improper Access Control. The vulnerability is due to access restrictions not being properly checked in the OAuth2 Device code flow, allowing users without correct authorization to obtain OAuth tokens and potentially access applications...

Denial Of Service (DoS)

MIT Kerberos 5 is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient validation of length fields in message tokens, allowing an attacker to cause invalid memory reads by sending tokens with invalid length values...

Plaintext Modification

libkrb5.so is vulnerable to a Plaintext Modification attack. The vulnerability is due to improper modifications in the plaintext Extra Count field of a confidential GSS krb5 wrap token, allowing an attacker to make an unwrapped token appear truncated to the application...

Cross-site Scripting (XSS)

TYPO3 is vulnerable to Cross-site Scripting. The vulnerability is due to failing to properly encode user input in some backend components...

Cross Site Scripting(XSS)

zenml is vulnerable to Cross-Site Scripting XSS . The vulnerability is due to improper input neutralization during web page generation within the survey redirect parameter, which allows an attacker to execute arbitrary JavaScript code in the context of the user's browser session...

Authentication Bypass

TYPO3 is vulnerable to Authentication Bypass. The vulnerability is due to the default authentication service failing to invalidate empty strings as passwords...

Improper Input Validation

github.com/gin-contrib/cors is vulnerable to Improper Input Validation. The vulnerability is caused due to improper handling of wildcards in origin strings in the parseWildcardRules function within the cors.go file. This allows an attacker to bypass origin restrictions by using similar but...

Denial Of Service (DoS)

IBM MQ is vulnerable to Denial Of Service DoS. The vulnerability is due to an error applying configuration changes, which an attacker could exploit to cause a Denial Of Service DoS...

Sensitive Information Disclosure

IBM MQ is vulnerable to Sensitive Information Disclosure. The vulnerability is due to a detailed technical error message being returned in the browser. An attacker can use this information in further attacks against the system...

Denial Of Service (DoS)

IBM MQ is vulnerable to Denial Of Service DoS. The vulnerability is due to an error processing messages when an API Exit using MQBUFMH is used. The attacker can exploit this to cause a denial of service in certain configurations...

Privilege Escalation

IBM MQ is vulnerable to Privilege Escalation. The vulnerability is due to incorrect privilege assignments, which allows an attacker to escalate their privileges under certain configurations...

Remote Code Execution

nltk is vulnerable to Remote Code Execution. The vulnerability is due to models containing pickled Python code, which could allow an attacker to execute arbitrary code. An attacker would need to preform a man-in-the-middle attack to modify the packaged pickles such as the averagedperceptrontagger...

Improper Certificate Validation

phpseclib/phpseclib is vulnerable to Improper Certificate Validation. The vulnerability is due to some characters in Subject Alternative Name fields in TLS certificates that are allowed to have a special meaning in regular expressions, leading to name confusion in X.509 certificate host...

Remote Code Execution (RCE)

torch is vulnerable to Remote Code Execution RCE. The vulnerability is caused by a lack of restriction on function calls when a worker node sends a PythonUDF to the master node, which then executes the function without proper validation within the torch.distributed.rpc framework. This allows...

Cross-site Scripting (XSS)

org.opencms: opencms-core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper validation of .svg files, allowing users with the roles of gallery editor or VFS resource manager to upload images containing JavaScript code, which will be executed when another user accesse...

Cross-site Scripting (XSS)

zendframework/zendframework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to view helpers using escapeHtml instead of escapeHtmlAttr to escape HTML attributes, which can lead to potential XSS attack vectors when user data or JavaScript is used...

Session Fixation

zendframework/zendframework is vulnerable to Session Fixation. The vulnerability is due to session validators not working as expected if set prior to the start of a session...

Heap Buffer Overflow

Libde265 is vulnerable to a Heap Buffer Overflow. The vulnerability is due to improper handling of a crafted payload that can cause a crash via the interceptormemcpy function, allowing an attacker to exploit the system...

Heap Buffer Overflow

Libde265 is vulnerable to a Heap Buffer Overflow. The vulnerability is due to a crafted payload in the display444as420 function at sdl.cc, which can allow attackers to crash the application...

Cross Site Scripting(XSS)

@zenuml/core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized Markdown comments in the file Comment.vue, allowing attackers to inject malicious JavaScript payloads...

Cross-site Scripting (XSS)

zendframework/zendframework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to not using context-appropriate escaping mechanisms with Zend\Escaper when escaping HTML, HTML attributes, and/or URLs, which could potentially be exploited to perform XSS attacks...

Use After Free

@fastly/js-compute is vulnerable to Use After Free. The vulnerability is due to re-use of previously freed memory in the FetchEvent.client and certain CacheEntry.prototype and Device.lookup functions. This issue could allow for an unintended data leak and often results in a Compute service crash...

Denial Of Service (DoS)

github.com/golang/image is vulnerable to Denial of Service DoS. The vulnerability is due to invalid color indices in a corrupt or crafted image. An attacker could exploit the lack of color index checks by providing an image with invalid color indices which triggers a crash...

Denial Of Service (DoS)

vrana/adminer is vulnerable to Denial of Service DoS. The vulnerability is caused due to improper handling of HTTP redirects, which allows an attacker to trigger a Denial of Service DoS condition by connecting adminer to an attacker controlled service...

Insertion Of Sensitive Information Into Log File

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source is vulnerable to Insertion Of Sensitive Information Into Log File. The vulnerability is due to the token being printed in the build log as part of the Bitbucket URL. An attacker can view the token and gain unauthorized access...

Code Injection

flowise is vulnerable to Code Injection. The vulnerability is due to improper input validation in the api/v1 endpoint, allowing a remote attacker to execute arbitrary code via a crafted script...

Cross-site Scripting (XSS)

djangorestframework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization via the breaklongheaders template filter. This allows an attacker to inject malicious scripts by exploiting the improper santization in the header processing...

Unencrypted Stored Credentials

org.jenkins-ci.plugins:plain-credentials is vulnerable to Unencrypted Stored Credentials. The vulnerability is caused when decrypting file contents to check for valid encrypted secrets, resulting in the file content being stored unencrypted only Base64 encoded. An attacker with access to the...

Server-Side Request Forgery (SSRF)

vrana/adminer is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the improper handling of user-supplied input in database connection fields. This allows an unauthenticated remote attacker to enumerate or access systems they would not otherwise have access to...

Cross-site Scripting (XSS)

TYPO3 is vulnerable to Cross-site Scripting XSS. The vulnerability is due to failing to properly encode user input in the login status display in the website frontend, requiring a valid user account either backend or frontend to exploit...

Information Disclosure

typo3/cms is vulnerable to Information Disclosure. The vulnerability is due to logging login failures, including plain-text user credentials, at the "warning" log level, which potentially leads to unauthorized access to sensitive user information...

Denial Of Service (DoS)

silverstripe/framework is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient authentication controls in the dev/build system controller, which could allow unauthorized users to trigger the dev/build process and potentially causing resource exhaustion and disrupting...

Code Injection

willdurand/js-translation-bundle is vulnerable to Code Injection. The vulnerability is due to a lack of validation of 'locale' parameter in 'Controller.php' file, which allows an attacker to inject javascript code...

Sensitive Information Disclosure

typo3/cms is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the Install Tool exposing the current TYPO3 version number to non-authenticated users...

Information Disclosure

silverstripe/framework is vulnerable to Information Disclosure. The vulnerability is due to sensitive database connection details potentially being exposed in stack traces when running in dev mode with the mysqli database driver...

Insufficient Session Expiration

zfr/zfr-oauth2-server-module is vulnerable to Insufficient Session Expiration. The vulnerability is due to a lack of token validation for expiration and validity, allowing users to potentially use invalidated authentication credentials...

Privilege Escalation

pgAdmin4 is vulnerable to Privilege Escalation. The vulnerability is caused by improper permissions set on the installation directory, allowing attackers to gain unauthorized access on Debian or RHEL 8 platforms...

Cross-site Scripting (XSS)

TYPO3 is vulnerable to Cross-site Scripting XSS. The vulnerability is due to failing to properly encode user input in notifications shown in modal windows in the TYPO3 backend...

URL Rewrite

zendframework/zend-feed is vulnerable to URL Rewrite. The vulnerability is due to marshaling a request URI that includes logic to introspect HTTP request headers specific to a server-side URL rewrite mechanism. The attacker can emulate these headers to request arbitrary content...

NULL Pointer Dereference

github.com/pingcap/tidb is vulnerable to a Null pointer dereference. The vulnerability is due to improper handling of nil pointers within the expression.inferCollation function, which allows attackers to crash the application...

Information Disclosure

aimeos/ai-client-html is vulnerable to Sensitive Information Exposure. The vulnerability is due to debug information revealing sensitive information from environment variables in error logs, allowing attackers to potentially access confidential data...

SQL Injection

silverstripe/postgresql is vulnerable to SQL injection. The vulnerability is due to the inadequate handling of table names in the silverstripe/postgresql database adapter, which allows malicious SQL injection attacks if table names are not properly escaped or sanitized...

URL Rewrite

zendframework/zend-diactoros is vulnerable to URL Rewrite. The vulnerability is due to marshaling a request URI that includes logic to introspect HTTP request headers specific to a server-side URL rewrite mechanism. The attacker can emulate these headers to request arbitrary content...