Arbitrary Code Execution

composer is vulnerable to Arbitrary Code Execution. The vulnerability due to improper santization when parsing the installed.php/InstalledVersions.ph file during the invocation of Composer. If Composer is invoked within a directory where InstalledVersions.ph was tampered with by an attacker,...

Cross Site Scripting (XSS)

github.com/rancher/norman is vulnerable to Cross Site Scripting XSS . The vulnerability is due to a lack of URL validation within the ParseRequestURL method. An attacker can execute arbitrary JavaScript by sending a crafted payload to a public API endpoint, resulting in XSS...

Use-After-Free

chromiumsid is vulnerability of Use-After-Free. The vulnerability due to potentially exploit heap corruption via a crafted HTML page. It allows a remote attacker could potentially exploit it to achieve heap corruption...

Heap Buffer Overflow

chromium sid is vulnerability of Heap buffer overflow. The vulnerability due to write more data to a heap-allocated buffer in the Skia graphics library, which is used in Google Chrome. It allows a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Cross Site Scripting (XSS)

com.liferay.portal:release.portal.bom and com.liferay.portal:release.dxp.bom are vulnerable to Cross Site Scripting XSS. The vulnerability is due to lack of user input validation within the search functionality if highlighting is disabled by adding any searchable content to the application...

Server-Side Request Forgery (SSRF)

libuv.so is vulnerable to Server-Side Request Forgery SSRF. The vulnerability arises due to how the hostnameascii variable with a length of 256 bytes is handled in uvgetaddrinfo and subsequently in uvidnatoascii. When the hostname exceeds 256 characters, it gets truncated without a terminating nu...

Denial Of Service (DoS)

com.liferay.portal:release.portal.bom is vulnerable to Denial Of Service DoS. The vulnerability is due improper resource consumption limits while generating a preview image. A remote, authenticated attacker can cause a DoS via a crafted image...

Denial Of Service (DoS)

Django is vulnerable to Denial Of Service DoS. The vulnerability is due to inefficient string processing within the intcomma template filter when a long string is parsed. This issue can be exploited by an attacker to cause DoS...

SQL Injection

SQLAlchemyDA is vulnerable to SQL Injection. The vulnerability is due to improper validation of SQL statements within the SQLAlchemyDA instance. This issue can be exploited by an attacker to execute arbitrary SQL statements in the database...

Directory Traversal

salt is vulnerable to Directory Traversal. The vulnerability is caused due to lack of proper path validation during the handling of URLs within the salt file server. This allows an attacker to craft a specially designed URL which results directory traversal...

Session Fixation

org.graylog2:graylog2-server is vulnerable to Session Fixation. The vulnerability is due to missing token checks when authentication is performed with an existing session id. Pre-existing session can be used to gain elevated access to an existing session, provided the attacker is able to inject a...

Arbitrary Code Execution

Graylog is vulnerable to Arbitrary Code Execution. The vulnerability is due to a lack of class validation, which allows an attacker to send a HTTP PUT request to the /api/system/clusterconfig/ endpoint which results in the loading of arbitrary classes. This issue can be exploited by an attacker b...

Improper Access Control

pimcore/admin-ui-classic-bundle is vulnerable to Improper Access Control. The vulnerability is due to lack of permission validation while creating and deleting tags. An attacker can create and delete tags without having the permission to do so...

Memory Leak

mupdf is vulnerable to a Memory Leak. The vulnerability is caused due to improper memory management within the menuEntry variable in the glutAddSubMenu function. This can potentially lead to a Denial of ServiceDoS attacks...

Memory Leak

mupdf is vulnerable to a Memory Leak. The vulnerability is caused due to improper memory management of the menuEntry variable within the glutAddMenuEntry function. This can potentially lead to a Denial of Service DoS attack...

Improper Authentication

org.apache.ozone ozone-main is vulnerable to Improper Authentication. The vulnerability is due to improper verification for the identity of a user accessing the Storage Container Manager service. This flaw allows an attackers to download internal metadata without the need for proper authenticatio...

Timing Attack

pulsar-broker-auth-sasl is vulnerable to a Timing Attack. The vulnerability is due to the verifyAndExtract function within SaslRoleTokenSigner.java because it take different amounts of time to return false depending on how many characters it needs to compare before finding a mismatch. This...

Improper Input Validation

libmysofa.so is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of multiplications and additions in the treeRead function within btree.c. The flaw could potentially allow attackers to execute arbitrary code or cause a buffer overflow...

Cross-site Scripting (XSS)

CKEditor4 is vulnerable to Cross-site Scripting. The vulnerability is due to editor instances that have enabled full-page editing mode or enabled CDATA elements in the Advanced Content Filtering configuration which defaults to script and style elements. This flaw allows an attacker to inject...

Cross Site Scripting (XSS)

ckeditor4 is vulnerable to Cross Site Scripting XSS. The vulnerability due to the preview feature which allows an attacker to execute arbitrary JavaScript resulting in XSS...

Improper Validation Of Array Index

vyper is vulnerable to Improper Validation Of Array Index. The vulnerability is due to the typechecker allowing usage of an int as an index for an array validation, allowing an attacker to manipulate the typechcker in such a way that the index will be forced to be negative which results in Denial...

Regular Expression Denial Of Service (ReDoS)

python-multipart is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to a Regular Expression with inefficient complexity utilized to parse the HTTP Content-Type header. An attacker can send a request with a crafted Content-Type option that consumes excessive CPU...

Denial Of Service( DoS)

libgit2 is vulnerable to Denial of Service DoS. The vulnerability is caused due to improper validation within src/revparse.c. If an attacker is able to provide crafted input to the gitrevparsesingle function, an infinite loop can occur resulting in Denial of Service...

Incorrect File Permission

org.springframework.security: spring-security-config is vulnerable to Incorrect File Permissions. The vulnerability is due to insecure permissions assigned to the spring-security.xsd file inside the spring-security-config jar which is world writable. An attacker with access to the filesystem can...

Insecure Deserialisation

clearml is vulnerable to Insecure Deserialisation. The vulnerability is due to Deserialisation of untrusted data. An attacker can upload a malicious pickle file via the project API to run arbitrary code on an end user's system...

Heap Buffer Overflow

libgit2 is vulnerable to Heap Buffer Overflow. The vulnerability is due to improper handling of string paths in the hasdirname function within index.c. This logic in path processing may cause the application to crash, resulting in Denial of Service DoS...

Improper Control Of A Resource Through Its Lifetime

github.com/cosmos/cosmos-sdk is vulnerable to Improper Control of a Resource Through its Lifetime. The x/crisis module is supposed to allow anyone to halt a chain in event of any violation. The vulnerability is caused due to x/crisis module, which does not halt the chain as expected upon an...

Open Redirect

github.com/go-macaron/i18n is vulnerable to Open Redirect. The vulnerability is caused due to a lack of URL validation within i18n.go. This allows an attacker to manipulate the URL parameter to redirect users to a malicious website...

Directory Traversal

Stimulsoft Dashboard.JS is vulnerable to Directory Traversal. The vulnerability is due to improper fileName validation within the Save function. This issue can be exploited by an attacker to perform directory traversal via fileName parameter, resulting in Arbitrary Code Execution...

Path Traversal

Gradio is vulnerable to Path Traversal. The vulnerability is due to improper validation when parsing a user supplied JSON value inan API request. This issue can be exploited by an attacker read am arbitrary file on the filesystem...

Path Traversal

clearml is vulnerable to Path Traversal. The vulnerability is due to a lack of file path validation, which allows an attacker to craft a malicious dataset which writes files to arbitrary locations on the system...

Path Traversal

org.apache.sling: org.apache.sling.servlets.resolver is vulnerable to Path Traversal. The vulnerability is due to the findScript function within SlingScriptResolverImpl.java allowing user-supplied paths without any validation and the resolveServletInternal function within SlingServletResolver.jav...

Improper Privilege Management

minio is vulnerable to Improper Privilege Management.The vulnerability is due to access keys inheriting permissions from parent keys, including admin rights, allowing them to override their own permissions...

Path Traversal

salt is vulnerable to Path Traversal. The vulnerability is caused by roots.py because there is no explicit path validation before performing file operations, as well as master.py creating directories and files based on unvalidated user input. An attacker can exploit these flaws to traverse and...

Misassignment Of Phantom Functions

xen is vulnerable to Misassignment of Phantom Functions. The vulnerability is due to the failure to properly handle the assignment of phantom functions when the IOMMU context setup fails. It allows attackers in the primary device being assigned to a guest while some phantom functions are assigned...

Arbitrary File Upload

mingSoft is vulnerable to Arbitrary File Upload. The vulnerability is due to improper validation when uploading files within the following POST request /ms/file/upload.do. This issue can be exploited by an attacker to upload arbitrary files...

Bleichenbacher Timing Attack

M2Crypto is vulnerable to Bleichenbacher Timing Attack. The vulnerability is due insecure padding schemes, resulting in the exposure of confidential or sensitive data...

Session Hijacking

github.com/hashicorp/boundary is vulnerable to Session Hijacking. The vulnerability is due to improper certificate validation. An attacker with privileges to enumerate the active active or pending sessions can obtain a session key and obtain a valid trust on the token. This results in an attacker...

Insufficient Entropy

github.com/consensys/gnark is vulnerable to Insufficient Entropy. The vulnerability is due to a flaw in randomness generation process which allows an attacker to generate a valid proof. The vulnerability allows a third party to derive a valid proof from a valid initial tuple. Note that the impact...

Stored Cross Site Scripting (XSS)

stimulsoft-dashboards-js is vulnerable to Cross Site Scripting. The vulnerability is due to improper sanitization for the ReportName field, which allows an attacker to create a stored XSS payload which remains active and is executed with specific user interactions, such as when a user clicks on t...

Cross Site Scripting (XSS)

stimulsoft-dashboards-js is vulnerable to Cross Site Scripting. The vulnerability is due to improper input validation in the search bar component, allowing a remote attacker to execute arbitrary code via a crafted payload...

Use After Free

libxml2 is vulnerable to Use After Free. The vulnerability is caused due to a lack of validation within the xmlTextReader module. When parsing a crafted XML document using the XML Reader interface with DTD validation and XInclude expansion enabled, a xmlValidatePopElement use-after-free exception...

Timing Attack

Cryptography is vulnerable to a Timing Attack. This vulnerability is due to the predictable structure of padding in ciphertexts during RSA encryption. This flaw enables an attacker to distinguish between different types of padding errors, potentially leading to the decryption of captured messages...

Improper Validation

vyper is vulnerable to Improper Validation. The vulnerability is caused due to a miscalculation in stack management during the compilation of the sha364 operation in the IR. This could allow an attacker to manipulate the input and exploit the error in stack management during compilation...

Side Channel Attack

github.com/containerd/containerd is vulnerable to Side Channel Attack. The vulnerability is caused due to an unprivileged access to Intel's RAPL Running Average Power Limit readings which provides software insights into hardware energy consumption. This can be exploited to mount power-based...

Account Spoofing

phpMyFAQ is vulnerable to User Account Spoofing. The vulnerability is due to the user removal page lacking backend validation, allowing an attacker to manipulate form details by intercepting the request via a proxy, which can allow an attacker to trick an admin into removing the account...

HTML Injection

Sulu is vulnerable to HTML Injection. The vulnerability is due to improper HTML sanitization within the the Tag name. The HTML is executed when the tag name is listed in the auto complete form...

Denial Of Service (DoS)

graphql-go is vulnerable to Uncontrolled Recursion. The vulnerability is caused due to improper malformed input checks within parser.go, which results in Denial Of ServiceDoS...

Arbitrary Code Execution

github.com/git-lfs/git-lfs is vulnerable to Arbitrary Code Execution. The vulnerability is due to Go preferring the current directory when the name of a command run does not contain a directory separator, in the case of Windows. This can result in arbitrary code execution if Git LFS operates on a...

Open Redirect

pyloadng is vulnerable to Open Redirect. The vulnerability is due to the issafeurl and getredirecturl functions within helpers.py improperly validating redirect URLs, which allows an attacker to redirect users to arbitrary domains after login...