Session Replay Attack

libosdp is vulnerable to a Session Replay Attack. The vulnerability is due to the lack of validation for RMACI messages in response to osdpSCRYPT, and the allowance of SCS14 on encrypted connections. Attackers with man-in-the-middle access can intercept RMACI replies during a session and replay...

Server-Side Request Forgery (SSRF)

RSSHub is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to SSRF vulnerabilities in RSSHub, enabling remote attackers to utilize the server as a proxy for sending HTTP GET requests to arbitrary targets. This could result in retrieving information from the internal networ...

Cross Site Scripting(XSS)

djangomarkdownx is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to insufficient sanitization of JavaScript elements in the upload functionality, allowing an attacker to store a specially crafted JavaScript payload...

Cross-site Scripting (XSS)

rsshub is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the internal media proxy failing to sanitize specially crafted images, which allows an attacker to upload an image resulting in XSS. This allows for the execution of arbitrary JavaScript code. Users accessing a...

XML Entity Expansion

libexpat is vulnerable to XML Entity Expansion. The vulnerability is caused due to insufficient input validation and handling of external entities in the XML parser. This allows an attacker to perform an XML Entity Expansion attack...

Privilege Escalation

libbcc is vulnerable to Privilege Escalation. The vulnerability is caused by a missing check for file existence and ownership validation within kbuildhelper.cc. This potentially leads to unauthorized access or privilege escalation...

Denial Of Service (DoS)

JWX is vulnerable to Denial of Service DoS. The vulnerability is caused due improper checking of the decompressed data size, allowing an attacker to craft a malicious input with an exceptionally high compression ratio, leading to a Denial of Service DoS condition by consuming excessive memory...

Path Traversal

WeasyPrint is vulnerable to Path Traversal. The vulnerability is due to improper validation mechanisms in the urlfetcher function, which fails to restrict the inclusion of arbitrary local files and URLs in the generated PDF documents. This flaw allowing an attacker to include or traverse to files...

Cross-site Scripting (XSS)

org.jenkins-ci.plugins, htmlpublisher is vulnerable to Cross-Site Scripting. The vulnerability is due to publishReports function within HtmlPublisher.java not having proper input sanitization, This flow allows attackers with Item/Configure permission to inject malicious scripts into job names,...

Improper Access Control

org.jenkins-ci.plugins, cloudbees-bitbucket-branch-source is vulnerable to Improper access control. The vulnerability is due to flaw in the authorization mechanism in the trust policy "Forks in the same account" allowing changes to Jenkinsfiles from users without write access to the project when...

Heap-based Buffer Overflow

libgpac.so is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to improper input size validation within the ffwrite component function in utils/osfile.c, which allows remote attackers to execute arbitrary code or cause a Denial of Service DoS through crafted input...

Null Pointer Deference

libgpac.so is vulnerable to Null Pointer Deference. The vulnerability is due to the gfdashsetupperiod function within dashclient.c which has no validation when parsing DASH manifest files to ensure values are non-null before accessing their properties. This flaw allow attackers to craft malicious...

Command Injection

github.com/1panel-dev/1panel is vulnerable to Command Injection. The vulnerability is caused due to a lack of proper input validation in the "Path" argument, This flaw allows an attacker to manipulate the "Path" and inject arbitrary commands and can potentially lead to Command Injection...

Use After Free

chromiumsid is vulnerable to Use After Free. The vulnerability is due to improper handling of memory after it has been freed, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Inappropriate Implementation

Google Chrome is vulnerable to Inappropriate Implementation. The vulnerability is due to an implementation error in the V8 engine, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Out Of Bounds Memory Access

chromium is vulnerable to Out Of Bounds Memory Access . The vulnerability is due to a flaw in the V8 JavaScript engine, allowing a remote attacker to perform out-of-bounds memory access via a crafted HTML page...

Improper Access Control

GitLab is vulnerable to Improper Access Control. The vulnerability is due to an authorization bypass affecting gitlab. An attacker could exploit this by utilizing a crafted payload in an old feature branch to bypass CODEOWNERS and perform malicious actions...

Improper Authorization

GitLab is vulnerable to Improper Authorization. The vulnerability is due to a privilege escalation flaw in GitLab. Users with a custom role of managegroupaccesstokens could rotate group access tokens with owner privileges, allowing them to escalate their privileges within the system...

Sensitive Information Exposure

Thunderbird is vulnerable to Sensitive Information Exposure. The vulnerability is due to the encrypted subject of an email message being incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. This could lead to the accidental leakage of confidential...

Improper Access Control

GitLab is vulnerable to Improper Access Control. The vulnerability is due to improper authorization in GitLab. Group members with sub-maintainer roles were able to change the title of privately accessible deploy keys associated with projects in the group, which they should not have permission to...

Denial Of Service (DoS)

iNet wireless daemon IWD is vulnerable to Denial of Service. The vulnerability is due to initialization issues in situations where parsing of advertised service information fails, leading to a denial of service daemon crash or potentially other unspecified impacts...

Data Amplification

github.com/go-jose/go-jose is vulnerable to Data Amplification. The vulnerability due to insufficient checks or controls in the handling of compressed data within the Decrypt or DecryptMulti functions. Specifically, when an attacker sends a JSON Web Encryption JWE containing compressed data, the...

OS Command Injection

paddlepaddle is vulnerable to OS Command Injection. The vulnerability is due to insufficient URL encoding in the scraping command implemented, allowing potential attackers to execute arbitrary commands on the host system, resulting in Command Injection...

Path Traversal

pgadmin4 is vulnerable to Path Traversal. The vulnerability is due to Insufficient Input Validation due to concatenating the sessions directory path with the session ID using the os.path.join function, without setting a trusted base path, allowing an attacker to manipulate the session ID and...

Denial Of Service (DoS)

jose is vulnerable to Denial Of Service DoS. This vulnerability is due to a flaw in the support for decompressing plaintext post-decryption. An attacker can exploit a scenario with exceptionally high compression ratios, leading to JWE token lengths falling below application-defined limits. This...

Remote Code Execution (RCE)

paddlepaddle is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of user input in the HDFSClient class within fs.py.This allows an attacker to execute arbitrary commands by injecting malicious input, resulting in Code Injection...

Improper Authorization

github.com/grafana/grafana/ is vulnerable to Improper Authorization. The vulnerability is due to the API allowing the creation of a data source with a universal identifier UID, granting unintended access to all organization data sources...

Command Injection

paddlepaddle is vulnerable to Command Injection. The vulnerability is caused due to the lack of proper input validation in the user-supplied data savepath and name parameters, which are directly incorporated into the subprocess call. This can lead to command injection...

Path Traversal

paddlepaddle is vulnerable to Path Traversal. The vulnerability is due to insufficient input validation, allowing attackers to manipulate file paths and overwrite arbitrary files on the system...

Insecure Deserialization

nGrinder is vulnerable to Insecure Deserialization. The vulnerability is caused due to a lack of proper input filtering during Java object deserialization within Connector.java. Specifically, unauthenticated users could submit serialized Java objects, leading to the potential execution of arbitra...

Denial Of Service (DoS)

Squid is vulnerable to Denial of Service via HTTP Chunked Decoder. The vulnerability is due to an uncontrolled recursion bug in the HTTP Chunked decoder in Squid. This bug allows a remote attacker to cause Denial of Service by sending a crafted, chunked, encoded HTTP message...

Sensitive Information Disclosure

Apache Linkis is vulnerable to Sensitive Information Disclosure. The vulnerability is caused by the inclusion of sensitive information password in the log statement. This potentially leads to exposure to sensitive information...

Insufficient Permission Validation

getgrav/grav is vulnerable to Insufficient Permission Validation. The vulnerability is due to enabling regular users with page creation privileges to access the Frontmatter feature when the datajsonheaderform parameter is included in the POST body while creating a page. The vulnerability is also...

Use Of Cache Containing Sensitive Information

Shopware is vulnerable to Use of Cache Containing Sensitive Information. The vulnerability is due to caching 404 pages with Session Cookies set in the cached response which is used by the Session Handler. This can allow an attacker to access the page with 404 response and steal the session cookie...

Cross Site Scripting(XSS)

esphome is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to unsanitized data being served with Content-Type: text/html; charset=UTF-8 in the API dashboard through Edit configuration file API. It allows a remote authenticated user to inject arbitrary web scripts and potentially...

Improper Authorization

github.com/IceWhaleTech/CasaOS-UserService is vulnerable to Improper Authorization. The vulnerability is due to improper path filtering in the URL of user avatar image files. The regular expression used in the code snippet fails to sufficiently restrict access, allowing unauthorized actors to...

Improper Authorization

github.com/1Panel-dev/1Panel/ is vulnerable to Improper Authorization. The vulnerability is due to insufficient access controls, allowing attackers to exploit the application to gain unauthorized access to the console page...

Username Enumeration

github.com/icewhaletech/casaos-userservice is vulnerable to Username Enumeration. The vulnerability is due to a disclosure of information in the application response with the error message 'User does not exist' or "Invalid password" providing a means for attackers to identify valid usernames,...

Deserialization Of Untrusted Data

org.apache.inlong/inlong-manager is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to improper handling of user-supplied input in AuditServiceImpl.java. The attacker can read arbitrary files by exploiting this vulnerability...

Improper Authorization

Plone is vulnerable to Improper Authorization. The vulnerability is caused due to improper access control checks, allowing remote attackers to view and list all files hosted on the website via sending a crafted request...

Cross Site Scripting

org.jenkins-ci.plugins:gitbucket is vulnerable to Cross Site Scripting. The vulnerability is due to inadequate sanitization of GitBucket URLs on build views, allowing attackers with job configuration access to exploit it...

Password Brute Force Attack

github.com/icewhaletech/casaos-userservice is vulnerable to Password Brute Force Attack. The vulnerability is due to a lack of control on login attempts missing a rate limit on login. This enables attackers to gain super user-level access to the server, allowing unauthorized access to the server...

Insufficiently Protected Credentials

github.com/cloudevents/sdk-go/v2 is vulnerable to Insufficiently Protected Credentials. The vulnerability is due to the improper use of cloudevents.WithRoundTripper, allowing the leakage of credentials to arbitrary endpoints when creating a cloudevents.Client with an authenticated http.RoundTripp...

Arbitrary Code Execution

RPyC is vulnerable to arbitrary code execution. The vulnerability is due to a flaw in the handling of the array attribute specifically when the server-side exposes a method that calls the attribute array for a client provided netref e.g., np.arrayclientnetref. A remote attacker can exploit this b...

Denial Of Service (DOS)

netresearch/jsonmapper and pocketmine/netresearch-jsonmapper is vulnerable to Denial Of Service. The vulnerability is due to there is no proper validation when constructing objects from scalar types. This flaw potentially leads to a server crash caused by malformed JSON...

Denial Of Service (DOS)

pocketmine/pocketmine-mp is vulnerable to Denial Of Service. The vulnerability is due to a lack of bounds checking when accessing inventory slots while calling function BaseInventory-getItem. This leads to an unhandled exception and potentially leads to Denial of service via malformed...

Improper Certificate Validation

github.com/hashicorp/vault is vulnerable to Improper Certificate Validation. The vulnerability is due to insufficient validation of client certificates when a non-CA certificate is configured as trusted. This flaw leads to authentication bypass using the TLS certificate auth method with non-CA...

Incorrect Authorization

Apache Archiva is vulnerable to Incorrect Authorization. The vulnerability is due to an issue that allows an unauthenticated attacker to modify account data, potentially leading to account takeover...

Incorrect Authorization

org.apache.archiva:archiva is vulnerable to Incorrect Authorization. The vulnerability is due to unauthorized users being able to register when registration is set to be disabled. This flaw potentially leads to an Access Restriction Bypass...

Denial Of Service

libheif.so is vulnerable to Denial Of Service. The vulnerability is due to improper handling of memory resources during the encoding process, allowing an attacker to trigger a denial of service attack...