39263 matches found
Improper Input Validation
moodle/moodle is vulnerable to Improper Input Validation. The vulnerability is due to inadequate verification of ReCAPTCHA activation on the login page, which results in captcha bypass...
Cross-site Request Forgery (CSRF)
moodle/moodle is vulnerable to Cross-Site Request Forgery. The vulnerability is due to a missing CSRF token in the admin preset tool...
Cross-site Scripting (XSS)
moodle/moodle is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient sanitization when opening the equation editor, leading to a stored XSS risk when editing another user's equation...
Deserialization Of Untrusted Data
mlflow is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused due to inadequate input validation in the loadmodel function within mlflow/pytorch/init.py. This allows an attacker to execute arbitrary code on the victim's system by injecting a malicious pickle object into a...
Denial Of Service (DoS)
github.com/envoyproxy/envoy is vulnerable to Denial Of Service DOS. The vulnerability is due to the async HTTP client buffering the mirror response with an unbounded buffer, which allows attackers to potentially cause an out-of-memory scenario by sending huge responses...
Request Smuggling
github.com/envoyproxy/envoy is vulnerable to Request Smuggling. The vulnerability is due to Envoy incorrectly accepting a 200 response code from a server when a protocol upgrade is requested, even though a 200 response does not indicate a protocol switch. Attackers could exploit this by tricking ...
Use After Free
github.com/envoyproxy/envoy is vulnerable to a use-after-free. The vulnerability is due to QUICHE continuing to push request headers after the StopReading method is called on the stream, which can lead to accessing a destroyed HCM ActiveStream object. This allows attackers to disrupt service by...
Infinite Loop
github.com/envoyproxy/envoy is vulnerable to an Infinite Loop. The vulnerability is caused when handling Brotli-compressed data with extra input, which causes the system to consume excessive resources and potentially become unresponsive to legitimate traffic. An attacker can exploit this with a...
Exposure Of Sensitive Information To An Unauthorized Actor
moodle/moodle is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to a misconfigured shared hosting environment that allows access to other users' content. This allows an attacker to execute arbitrary local file includes by restoring wiki modules...
Code Execution
javascript-deobfuscator is vulnerable to Code Execution. The vulnerability is due to crafted payloads targeting expression simplification, which allows an attacker to execute arbitrary code...
Arbitrary File Read And Write
qdrant-client is vulnerable to Arbitrary file read and write. The vulnerability is due to the snapshot recovery process allowing manipulation of snapshot files to include symlinks and also allows for the reading and writing of arbitrary files on the server...
Use After Free
Envoy is vulnerable to a Use-After-Free vulnerability. The vulnerability is due to improper handling in HttpConnectionManager HCM with EnvoyQuicServerStream, where an attacker can crash Envoy by sending a request without FIN, followed by a RESETSTREAM frame, and then closing the connection after...
Path Traversal
github.com/cri-o/cri-o is vulnerable to Path Traversal. The vulnerability is due to the path of the /etc directory being relative to the base of the container, which could lead to a container escape...
Reflected Cross Site Scripting (XSS)
dolibarr/dolibarr is vulnerable to a Reflected Cross-site Scripting XSS. The vulnerability is due to improper input validation in htdocs/compta/paiement/card.php, allowing remote attackers to inject arbitrary web script or HTML via the facid parameter...
Integer Underflow
Envoy is vulnerable to Integer Underflow. The vulnerability is due to an integer underflow in the QuicStreamSequencerBuffer::PeekRegion implementation, causing a crash at QuicheDataReader::PeekVarInt62Length...
Sensitive Information Disclosure
netty-incubator-codec-ohttp is vulnerable to Sensitive Information Disclosure. The vulnerability due to an error in the BoringSSLAEADContext which results the encryption nonce overflowing. An attacker can manipulate the nonce repetition by causing the sequence number to overflow, which decreases...
Integer Overflow
libaom.so is vulnerable to Integer Overflow. The vulnerability is caused by calling aomimgalloc with a large value of the dw, dh, or align parameter which results in integer overflows in the calculations of buffer sizes...
Integer Overflow
libvpx.so is vulnerable to Integer Overflow. The vulnerability is caused by calling large values of the dw, dh, or align parameter in the functions vpximgalloc and vpximgwrap, leading to invalid buffer sizes and offsets...
XML External Entity (XXE) Injection
typo3/cms is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper handling of XML input, which allows attackers to load internal or external files within an XML structure and potentially inject arbitrary files to cause a denial of service or other attacks...
Denial Of Service (DoS)
typo3/cms is vulnerable to Denial of Service DoS. The vulnerability is caused by allowing an excessively high maximum result limit in TYPO3's Indexed Search component. This flaw potentially enables attackers to execute a Denial of Service DoS attack...
Cross-Site Scripting
typo3/cms is vulnerable to Cross-Site Scripting. The vulnerability is due to improper sanitization of user input in the CSS styled content component, which allows an authenticated users to inject arbitrary HTML or JavaScript...
Command Injection
gradio is vulnerable to Command Injection. The vulnerability is due to improper neutralization of special elements within the test-functional.yml CI work flow, which results in unauthorized modification of the base repository or exfiltration of the GITHUBTOKEN, COMMENTTOKEN, or...
Sensitive Information Disclosure
keycloak-services is vulnerable to Sensitive Information Disclosure. The vulnerability is due to client-provided parameters included in plain text within the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request...
Cross-Site Scripting
typo3/cms is vulnerable to Cross-Site Scripting. The vulnerability is due to improper sanitization within the bookmark toolbar, which allows attackers to execute arbitrary scripts in the context of the user's browser session...
Denial Of Service (DOS)
pimcore/pimcore is vulnerable to Denial Of Service. The vulnerability due to the lack of restrictions on the scaling factors that can be applied to image thumbnails, potentially creating disproportionately large files or overwhelming server CPU resources...
Information Disclosure
TYPO3/CMS is vulnerable to Information Disclosure. This vulnerability arises from insufficient validation and handling of uploaded files within forms. It may result in arbitrary file disclosure or unauthorized access to sensitive system files...
Improper Input Validation
actionpack is vulnerable to Improper Input Validation. The vulnerability is due to improper handling of security headers for non-HTML content types, which allows an attacker to potentially bypass security restrictions by sending specially crafted requests that exploit the lack of these security...
Cross-site Scripting(XSS)
actiontext is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the lack of sanitization of HTML content within instances of ActionText::Attachable::ContentAttachment included in a richtextarea tag, which results in unsanitized HTML rendering...
Out-of-Bounds-Read
org.iq80.snappy: snappy is vulnerable to Out-of-Bounds-Read. The vulnerability is due to the usage of the JDK class sun.misc.Unsafe to speed up memory access without performing additional bounds checks, which can result in non-deterministic behavior or a JVM crash...
Denial Of Service (DoS)
directus is vulnerable to Denial Of Service DoS. The vulnerability is caused by providing a non-numeric length value to the random string generation utility, which prevents the generation of random session IDs, resulting in Denial Of Service DoS...
Path Traversal
lollms is vulnerable to Path Traversal. The vulnerability is due to improper handling of user-supplied input in the 'listpersonalities' endpoint, allowing an attacker to traverse directories and view the contents of subfolders by manipulating the 'category' parameter in an HTTP request...
Cross-site Scripting (XSS)
typo3/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of user input, allowing authenticated editors to inject arbitrary HTML or JavaScript...
Type Confusion
chromium is vulnerable to Type Confusion.This vulnerability due to type confusion in the V8 engine, which fails to properly handle object types, allowing remote attackers to execute arbitrary code within a sandbox environment via a specially crafted HTML page...
Cross-site Flashing
typo3/cms is vulnerable to Cross-site Flashing. The vulnerability is due to missing validation of flash and image files, allowing the embedding of flash videos from external domains...
Cross-site Scripting (XSS)
typo3/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of editor input in the search result view, allowing authenticated editors to inject arbitrary HTML...
Sensitive Information Exposure
chainguard.dev/apko is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper redaction of sensitive information within error log output, where HTTP basic auth credentials from repository and keyring URLs are exposed, which allows an attacker with access to logs to...
SQL Injection
github.com/goharbor/harbor is vulnerable to SQL Injection. The vulnerability is due to the improper usage of prepared statements within the ListScanTasksByReportUUID function in task.go, which allows an attacker with administrator, projectadmin, or projectmaintainer roles to execute arbitrary SQL...
Sensitive Information Disclosure
ethycafides is vulnerable to Information Disclosure. The vulnerability is due to improper masking of nested sensitive fields such as privatekey in the BigQuery connection configuration, which allows an attacker to expose the sensitive fields in plaintext via certain API endpoints...
Open Redirect
github.com/goharbor/harbor is vulnerable to open redirect. The vulnerability is due to a lack of validation for the redirecturl parameter with the OIDC authentication, which allows attackers to redirect users to malicious sites after login...
Cleartext Password Storage
statamic/cms is vulnerable to Cleartext Password Storage. This vulnerability is due to the insecure handling of password confirmation data, which affects users registered via the user:registerform tag and using file-based user accounts. The vulnerability allows an attacker, who gains access to us...
Authentication Bypass
github.com/casgate/casgate is vulnerable to Authentication Bypass. The vulnerability is due to improper authorization checks using the id parameter in GET requests, which allows attackers to bypass authentication and access sensitive information remotely without authorization...
Arbitrary Code Execution
yiisoft/yii2 is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper validation in the set magic function when attaching behaviors to components, allowing instantiation of arbitrary classes if attacker-controlled input is provided...
Cross Site Scripting (XSS)
@wangeditor/editor is vulnerable to Cross-site scripting XSS. The vulnerability is due to missing input sanitization within the image upload function, which allows an attacker to execute arbitrary JavaScript in the browser...
Improper Input Validation
github.com/ollama/ollama is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of the digest format sha256 with 64 hex digits when getting the model path, which results in the mishandling of the TestGetBlobsPath test cases with fewer than 64 hex digits, more...
Cross-Site Scripting (XSS)
yiisoft/yii2 is vulnerable to Cross-site Scripting XSS. The vulnerability is caused by improper handling of quote conversion in the htmlspecialchars function, allowing an attacker to inject malicious attributes though argument values in exception stack traces...
SQL Injection
typo3/cms is vulnerable to SQL injection. The vulnerability is due to a flaw in the database escaping API when configured for MySQL passthrough mode, which affects all queries using DatabaseConnection::sqlquery, even if arguments were properly escaped with DatabaseConnection::quoteStr...
Use After Free
libmodbus is vulnerable to a Use After Free. The vulnerability is caused by improper handling of the ctx-backend pointer, which allows attackers to cause a Denial of Service DoS via a crafted message sent to the unit-test-server...
Cross-site Scripting (XSS)
activeadmin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input in dynamic legends, which allows for the injection of arbitrary JavaScript code when creating entities with names that include a script payload...
Denial Of Service (DoS)
libmodbus is vulnerable to Denial of Service DoS. The vulnerability is due to an invalid pointer in the modbusreceive function, triggered by a crafted message sent to the unit-test-server, which results in Denial of Service DoS...