Exposure Of Resource To Wrong Sphere

Apache-airflow is vulnerable to Exposure of Resource to Wrong Sphere. The vulnerability is due to improper permission checks in the API and UI components. An attacker can view DAG code and import errors for DAGs they are not authorized to access by exploiting this vulnerability...

Uncontrolled Resource Consumption

Mattermost is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the failure in limiting the number of role names that can be requested from the API. An attacker can cause the server to run out of memory and crash by issuing an unusually large HTTP request...

Cross-site Request Forgery (CSRF)

phpPgAdmin is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient validation of the request source in the "database.php" area of phpPgAdmin. This allows sensitive actions to be performed without proper verification of the request's origin. A remote attacker can...

Out-of-bounds Read

@openzeppelin/contracts, @openzeppelin/contracts-upgradeable are vulnerable to Out-of-bounds Read. The vulnerability is due to Base64.encode function which encodes a byte input by iterating over it in chunks of 3 byte and reading the parts of the memory beyond the input buffer when the input is n...

Improper Access Control

github.com/mattermost/mattermost/ is vulnerable to Improper Access Control. The vulnerability is due to inadequate authorization checks for requests fetching the team associated AD/LDAP groups. This enables users to retrieve details of AD/LDAP groups from teams they are not part of...

Improper Access Control

github.com/mattermost/mattermost/ is vulnerable to Improper Access Control. The vulnerability is due to a failure in restricting the access of files attached to posts in an archived channel even if the Allow users to view archived channels option is disabled. This may lead to leak of sensitive...

Improper Access Control

github.com/mattermost/mattermost/ is vulnerable to Improper Access Control. The vulnerability is due to a failure to check compliance export settings, allowing non-members to fetch posts without being audited. Attackers can exploit this to access sensitive information without detection...

Memory Leak

libming/libming is vulnerable to Memory Leak. The vulnerability is due to heap memory allocations on Characters and Actions within the function parseSWFDEFINEBUTTON, which are not subsequently deallocated. This allows an attacker to trigger a Denial of Service DoS through a manipulated SWF file...

Cross Site Scripting(XSS)

cockpit-hq/cockpit is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to inadequate input validation, allowing an authenticated user to upload a PDF file containing a malicious JavaScript payload, which is executed upon file upload...

Open Redirect

docassemblewebapp is vulnerable to open redirect. The vulnerability is due to inadequate validation or sanitization of user input in the redirect URL parameter, allowing malicious actors to create URLs that redirect users to arbitrary external websites...

Cross Site Scripting

concrete5/concrete5 is vulnerable to cross-site scripting. The vulnerability is due to inadequate input validation on user-supplied data through the URL path /dashboard/system/basics/name, allowing malicious scripts to be stored and executed in the context of the user's browser when the affected...

Memory Leak

libming/libming is vulnerable to Memory Leak. The vulnerability is due to the allocation of brec-GlyphCount into heap memory inside function parseSWFTEXTRECORD, which is never freed. This allows attackers to execute a Denial of Service DoS by exploiting the flaw with a crafted SWF file...

Out-Of-Bounds

arm-trusted-firmware is vulnerable to a potential out-of-bounds. The vulnerability is due to insufficient validation of the input parameter in register x1 within the sdeiinterruptbind function and this parameter is subsequently used in the platicgetinterrupttype call, allowing an arbitrary value...

Sensitive Information Disclosure

Mattermost server is vulnerable to Sensitive Information Disclosure. The vulnerability is caused as the server fails to sanitize data associated with permalinks when a plugin updates an ephemeral post. This results an authenticated attacker who can control the ephemeral post update to access...

Classic Buffer Overflow

zephyrproject-rtos/zephyr is vulnerable to Classic Buffer Overflow. The vulnerability is due to not properly checking the length of the path before copying it into the dirpath in the ismountpoint function within fusefsaccess.c.This potentially leads to Denial of Service DoS...

HTML Injection

docassemblewebapp is vulnerable to HTML injection. The vulnerability is due to improper handling of user-added HTML including user's name field, allowing the input to be displayed on the screen as HTML which can also include...

Race Condition

github.com/mattermost/mattermost-server is vulnerable to a race condition. The vulnerability is due to a failure in handling concurrent requests of post creation and post deletion. An authenticated attacker can exploit this to gain an unauthorized access to individual post's contents via carefull...

Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to an information disclosure. The vulnerability is due to insufficient sanitization of the metadata on posts containing permalinks under specific conditions, allowing an authenticated user to access the contents of individual posts in channels...

Cross Site Request Forgery (CSRF)

concrete5/concrete5 is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to the sequential and numeric nature of event IDs via /ccm/calendar/dialogs/event/delete/submit endpoint, allowing an attacker to manipulate an admin into unintentionally deleting events on the site...

Improper Access Control

Mattermost is vulnerable to Improper Access Control. The vulnerability is due to an improper check of the inviteguest permission, allowing a member with permissions to add other members but not to add guests to add a guest to a team, provided the guest was already a guest in another team of the...

Denial Of Service (DOS)

github.com/mattermost/mattermost-server is vulnerable to a Denial of Service DoS. The vulnerability is due to improper validation of the length of the emoji value in the custom user status, allowing an attacker to send a very long string as an emoji value multiple times, causing high resource...

Denial Of Service (DoS)

jose2go is vulnerable to Denial of Service DoS. The vulnerability is caused due to a lack of input validation and handling for the "p2c" PBES2 Count parameter. This allows an attacker to provide a large "p2c" value, leading to a Denial of Service DoS CPU consumption vulnerability...

Cross Site Request Forgery (CSRF)

concrete5/concrete5 is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient validation in the /ccm/system/dialogs/file/delete/1/submit endpoint, allowing attackers to forge requests to delete files without proper authorization...

Server Side Request Forgery (SSRF)

mpdf/mpdf is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to not sanitizing user input while creating PDF when using html2pdf service. An attacker can exploit this flaw to use crafted html to include any arbitrary URL in the input to read the data from or to attack the...

Memory Leak

libming.so is vulnerable to Memory Leak. The vulnerability is due to the failure to de-allocate the memory from SWFParserstruct variable in parser.c. The attacker can perform a DoS via a crafted SWF file...

Cross Site Scripting (XSS)

Flask-AppBuilder is vulnerable to Cross-Site Scripting XSS. The vulnerability is caused by insufficient sanitization of user-provided data in the handling of URLs within the OAuth login page, allowing an attacker inject and execute malicious JavaScript code in the user's browser...

Deserialization Of Untrusted Data

org.apache.james: james-server is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to a JMX endpoint being exposed on localhost, allowing exploitation with a deserialization gadget, potentially resulting in privilege escalation or remote code execution...

Cross Site Scripting (XSS)

intelliants/subrion is vulnerable to Cross Site Scripting XSS. The vulnerability is due to inadequate input sanitization in the adminer.php script, allowing attackers to inject malicious scripts into web pages viewed by other users...

Insecure Default Initialization Of Resource

github.com/cometbft/cometbft is vulnerable to Insecure Default Initialization Of Resource. The vulnerability is due to insufficient default values for EvidenceParams.MaxAgeNumBlocks and EvidenceParams.MaxAgeDuration consensus parameters, leading to premature expiration of evidence and potential...

Sensitive Information Disclosure

Apache Superset is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper error handling when an authenticated user with privileges to create an Alerts generates a specially crafted SQL statement that triggers an error on the database which is not properly handled...

SQL Injection

intelliants/subrion is vulnerable to SQL Injection. The vulnerability is due to unsanitized user-controlled data used while constructing a query. This allows attackers to manipulate sql queries and execute arbitrary sql commands...

Incorrect Authorization

Apache Superset is vulnerable to Incorrect Authorization. The vulnerability is due to improper access check where a low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object...

Denial Of Service (DoS)

Rack is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of Range headers, allowing an attacker to craft headers in a way that results in an unexpectedly large response, which can result in Denial of Service DoS...

Access Control Bypass

mezzanine is vulnerable to an Access Control Bypass. The vulnerability is caused by a crafted request to the admin panel allowing unauthorized individuals to bypass restrictions and potentially gain unauthorized access...

Slashing Evasion Through Re-Delegation

github.com/cosmos/cosmos-sdk is vulnerable to slashing evasion during re-delegation. The vulnerability is due to an issue in the slashing mechanism that allows delegations contributing to byzantine behavior of a validator to evade slashing penalties through re-delegation, if the validator has not...

Cross-Site Scripting(XSS)

YARD is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input within the frames.erb template file, allowing an attacker to inject arbitrary JavaScript into the page...

Missing Permission Checks

com.hazelcast:hazelcast is vulnerable to Missing Permission Checks. The vulnerability is due to some client operations not checking permissions properly. This flaw allowing authenticated users to access data stored in the cluster...

Denial Of Service

rack is vulnerable to a Denial of service. The vulnerability is due to header parsing routines being susceptible to carefully crafted headers, which can cause the parsing process to take longer than expected, leading to a possible denial of service issue. This specifically impacts the Accept and...

XML External Entity

org.apache.ambari.contrib.views:wfmanager is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper validation of user input, specifically within the Oozie Workflow Scheduler, allowing for root-level file reading and privilege escalation from low-privilege users...

Improper Authorization

apache-superset is vulnerable to Improper Authorization. The vulnerability is due to a user with custom roles that include can write on dataset which allows them to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to...

Improper Authorization

apache-superset is vulnerable to Improper Authorization. The vulnerability is due to improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization...

Authentication Bypass

flaskappbuilder is vulnerable to Authentication Bypass. The vulnerability is due to the manipulation of authentication requests to deceive the backend into utilizing any specified OpenID service, which allows an attacker to forge an HTTP request to gain unauthorized privileged access. Note that...

Improper Neutralization

apache-superset is vulnerable for Improper Neutralization. The vulnerability is caused by a guest user sending syntactically incorrect SQL statements to the chart data rest api. When the API returns an error, sensitive analytic database information is leaked...

Denial Of Service (DOS)

NodeJS is vulnerable to Denial Of Service DOS. The vulnerability is caused due the fact that the fetch function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed int...

Improper Privilege Management

MinIO is vulnerable to Improper Privilege Management. The vulnerability is caused due to an improper access control checks where the access key hierarchy in MinIO allows the creation of access keys that inherit permissions from the parent key, enabling the override of s3 permissions, including...

Improper Access Control

LakeFS is vulnerable to Improper Access Control. The vulnerability is due to improper permission validation, enabling users with ci:ReadAction to access unauthorized data by copying objects to accessible paths...

SMTP Smuggling

Apache James is vulnerable to SMTP Smuggling. The vulnerability is due to the lenient behavior in line delimiter handling which creates a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypas...

Double Free

microsoft.azure.uamqp is vulnerable to Double Free. The vulnerability is due to an incorrect AMQPVALUE failed state resulting in a double free exception and possible remote code execution...

Session Token Disclosure

activestorage is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the Set-Cookie header getting cached when serving blobs if Rails is behind a proxy. Certain proxies may cache the Set-Cookie header, which can result in a users session being disclosed to another user...

Header Injection

org.apache.james: apache-mime4j-core is vulnerable to Header Injection. The vulnerability is due to improper input validation when using MIME4J DOM to compose messages, which allows an attacker to add unintended headers to MIME messages...