Use-After-Free

Firefox vulnerable to a use-after-free vulnerability. The vulnerability is due to improper handling where a use-after-free could occur if a JavaScript realm was being initialized when garbage collection started...

Memory Safety Bug

Firefox is vulnerable to memory safety bugs. The vulnerability is due to memory corruption, with evidence indicating potential exploitation to execute arbitrary code...

Memory Safety Bug

Firefox and Thunderbird are vulnerable to a Memory Safety Bug. The vulnerability is due to memory corruption, with evidence indicating potential exploitation to execute arbitrary code...

Use-After-Free

Firefox and Thunderbird are vulnerable to a use-after-free vulnerability. The vulnerability is due to incorrect reference counting, where assigning an AlignedBuffer to itself can lead to an incorrect reference count and subsequent use-after-free...

Memory Access Issue

Firefox is vulnerable to a memory access issue. The vulnerability is due to accessing uninitialized memory when the MarkStack assignment operator, part of the JavaScript engine, is used in a self-assignment...

Denial Of Service (DoS)

firefox is vulnerable to Denial of Service DoS. The vulnerability is due to an empty shape list caused by memory exhaustion, leading to a crash if the JIT traces the object...

Unauthorized Access

virtualBox is vulnerable to Unauthorized Access. The vulnerability is due to inadequate access controls to the Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to inadequate access controls to Oracle VM VirtualBox product of Oracle Virtualization, allowing a high privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Denial Of Service (DoS)

virtualBox is vulnerable to Denial of Service DOS.The vulnerability is due to insufficient input validation in VM VirtualBox product of Oracle Virtualization , allowing a low privileged attacker with login access to compromise Oracle VM VirtualBox installations...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to inadequate access controls to Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise installations of Oracle VM VirtualBox...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to insufficient security controls in Oracle VM VirtualBox affects Linux hosts and stems from a flaw in the Core component, allows a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to inadequate access controls in Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Privilege Escalation

virtualbox is vulnerable to Privilege Escalation. The vulnerability is due to insufficient access controls in Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to insufficient access controls in the Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to insufficient access controls in the Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to inadequate access controls in the Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Privilege Escalation

virtualBox is vulnerable to Privilege Escalation. The vulnerability is due to inadequate access controls in the Oracle VM VirtualBox product of Oracle Virtualization, allowing a low-privileged attacker with login credentials to compromise Oracle VM VirtualBox installations...

Cross-site Scripting (XSS)

geonode is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization within the rich text editor, which allows an attacker to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover...

Cross-site Scripting (XSS)

keycloak is vulnerable to Cross-site Scripting XSS. The vulnerability is due to allowing arbitrary URLs, including JavaScript URIs javascript:, as SAML Assertion Consumer Service POST Binding URL ACS. Allowing JavaScript URIs in combination with HTML forms results in Cross-site Scripting in the...

Authorization Bypass

keycloak is vulnerable to Authorization Bypass. The vulnerability is due to a hardcoded permissive regular expression which is used to filtering allowed hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with specific...

Denial Of Service

@solana/web3.js is vulnerable to Denial Of Service. The vulnerability is due improperly handling of particular inputs, which can cause memory exhaustion, leading to application crash and loss of availability...

Server-side Request Forgery (SSRF)

gradio is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to improper handling of the 'file' parameter in a GET request, enabling attackers to scan and identify open ports within an internal network by observing responses for 'Location' headers or 'File not allowed' error...

Code Injection

keras is vulnerable to Code Injection. The vulnerability is due to improper model sanitization through the Lambda layer, allowing an attacker to inject arbitrary Python code into a model via a lambda function. If an unsuspecting developer then loads this model, arbitrary code execution occurs...

Cross Site Scripting (XSS)

@excalidraw/excalidraw is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization against HTML injection in two vectors: rendering untrusted strings as iframe's srcdoc and attribute HTML injection in conjunction with allowing the allow-same-origin sandbox flag...

Session Hijacking

org.keycloak:keycloak-services is vulnerable to Session Hijacking. This vulnerability is due to an issue where an active Keycloak session can be hijacked by initiating a new authentication using the query parameter prompt=login, prompting the user to enter their credentials again. If the user...

Buffer Overflow

libfrr.so is vulnerable to Buffer Overflow. The vulnerability is due to inadequate validation of the size of Segment Routing subTLVs in ospfteparseri function within ospfte.c. An attacker can trigger this vulnerability by crafting OSPF LSA packets with maliciously crafted Segment Routing subTLVs...

Session Hijacking

dolibarr/dolibarr is vulnerable to Session Hijacking. The vulnerability is due to inadequate user session management, allowing authenticated attackers to hijack victim users' session cookies and gain access to the CSRF protection tokens through interaction with a malicious web page, consequently...

Improper Logs Output Neutralization

org.keycloak:keycloak-services is vulnerable to Improper Logs Output Neutralization . The vulnerability is due to errors in the browser client setup/auth process with "Security Key login" WebAuthn, which are written into the form, sent to Keycloak, and are logged without proper escaping, which...

Path Traversal

mlflow/mlflow is vulnerable to a Path Traversal. The vulnerability is due to improper validation of the source parameter within handlers.py, allowing attackers to craft a parameter that bypasses checks, leading to arbitrary file read access on the server...

Improper Authentication

org.keycloak:keycloak-services is vulnerable to Improper Authentication. This vulnerability is due to improperly enforcement of token types, allowing an authenticated attacker to exchange a logout token for an access token, potentially accessing data beyond permitted permissions...

Incorrect Access Control

org.keycloak, keycloak-services is vulnerable to Incorrect Access Control. The vulnerability is due to inadequate validation of client step-up authentication in the Keycloak library. It allows a password-authenticated attacker to add a false second authentication factor to an account, enabling...

Use-after-free

Torch is vulnerable to a use-after-free vulnerability. The vulnerability is due to missing validation checks in the run function within interpreter.cpp, which can potentially lead to a Denial of Service DoS...

Information Disclosure

Umbraco is vulnerable to Sensitive Information Disclosure. The vulnerability is due to failing webhooks logs being accessible when the solution is not in debug mode, which can contain critical information...

Denial Of Service (DOS)

github.com/evmos/evmos is vulnerable to a Denial Of Service. The vulnerability is due to improper handling of nested MsgEthereumTx messages, allowing bypass of the block gas limit and causing indefinite chain halts...

Path Traversal

org.keycloak:keycloak-services is vulnerable to Path traversal. The vulnerability is due to a flaw in the redirecturi validation logic that may allow bypassing otherwise explicitly allowed hosts...

Improper Access Control

github.com/evmos/evmos is vulnerable to Improper Access Control. The vulnerability is due to Evmos allowing the creation of a vesting account at a designated address for smart contracts on the EVM, enabling attackers to front-run the creation of a contract and block legitimate contract deployment...

Open Redirect

org.springframework: spring-web is vulnerable Open Redirect. The vulnerability is caused due to improper validation checks on the host of the parsed URL, which could lead to potential SSRF attacks if the URL is utilized post-validation...

Cross-Site Request Forgery (CSRF)

org.keycloak, keycloak-services is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to inadequate validation of cross-origin messages in Keycloak's OIDC component's "checkLoginIframe," allowing attackers to exploit Cross-Site Request Forgery CSRF attacks...

Open Redirect

org.keycloak, keycloak-services is vulnerable to Open Redirect. The vulnerability is due to inadequate validation of URLs included in redirects, potentially allowing attackers to access other URLs and sensitive information within the domain or conduct further attacks...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability is due to improper handling of URL parameters, allowing attackers to smuggle path traversal sequences using the ';' character in URLs, manipulating the 'params' portion of the URL to gain unauthorized access to files or directories...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of user-supplied input in the server's handlers, allowing attackers to access arbitrary files on the server by crafting HTTP POST requests with specially crafted parameters...

Denial Of Service

github.com/traefik/traefik is vulnerable to Denial Of Service. The vulnerability is due to a lack of header frame limits, allowing an attacker to send excessive CONTINUATION frames which causes the endpoint to read arbitrary amounts of header data without proper memory allocation limits...

Authorization Bypass

github.com/openfga/openfga is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of exclusion or intersection models, leading to potential bypass when calling certain APIs...

Biased ECDSA Nonce Generation

PuTTYis vulnerable to biased ECDSA nonce generation. The vulnerability is due to biased ECDSA nonce generation, allowing an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is particularly significant in scenarios where an adversary can re...

Cross Site Scripting (XSS)

phlex is vulnerable to Cross Site Scripting. The vulnerability is due improper filtering of javascript: URL scheme within the href attribute of an tag, which allows an attacker to insert tab \t or newline \n characters between the characters of the protocol, resulting in Cross Site Scripting...

Information Leakage

scrapy is vulnerable to Information Leakage. The vulnerability is due to the failure to remove the Authorization header when redirecting across domains, resulting in the exposure of sensitive credentials to unauthorized actors which could potentially lead to account hijacking...

Path Traversal

langchain is vulnerable to Path Traversal. The vulnerability is due to improper pathname validation in the LocalFileStore functionality, which allows an attacker to read or write files anywhere on the filesystem...

Local File Inclusion (LFI)

mlflow is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper parsing of URIs within the function islocaluri in uri.py,, which allows an attackers to read arbitrary files on the system...

Denial Of Service (DOS)

Apache Traffic Server ATS is vulnerable to an HTTP/2 CONTINUATION DoS attack. The vulnerability is due to the attack causing ATS to consume more server resources, potentially leading to resource exhaustion. Users can mitigate this by setting a new setting...

XML External Entity (XXE)

scrapy is vulnerable to XML External Entity XXE. The vulnerability is due to the lxml.etree.fromstring function which lacks input validation, enabling attackers to execute denial of service attacks, access local files, create network connections, or bypass firewalls through specially crafted XML...