Weak TLS Encryption

MeshCentral is vulnerable to TLS Downgrade Attack. The vulnerability is due to the usage of TLS that includes known vulnerabilities. An attacker can possibly eavesdrop on communication as result of this vulnerability...

Path Traversal

aiohttp is vulnerable to Path Traversal. The vulnerability is due to faulty path validation which checks if the file being accessed is within the intended static root directory when followsymlinks = True. This allows an attacker to access files and directories outside the intended static root...

Remote Code Execution

Nginx-UI is vulnerable to Remote Code Execution. The vulnerability is due to improper input validation within testconfigcmd or startcmd. This issue can be exploited by an attacker by modifying the values, resulting in Remote Code Execution...

Authentication Bypass

Authentik is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of the codechallenge parameter from the PKCE authorization request. This issue can be exploited by an attacker by removing the codechallenge parameter resulting in authentication downgrade...

Cross Site Scripting (XSS)

Orthanc is vulnerable to Cross Site Scripting XSS. The vulnerability is caused due to a missing sanitization in the server's error reporting. This can lead to compromising Confidentiality and Integrity of the system...

HTTP Request Smuggling

chasquid is vulnerable to HTTP Request Smuggling. The vulnerability is caused because of LF-terminated lines being accepted. This can lead to compromizing Integrity of the system...

Improper Access Control

GitLab EE is vulnerable to Improper Access Control. The vulnerability is caused due to a flaw in authorization check while approving previously approved merged request. This flaw can be exploited to bypass CODEOWNERS approval by adding changes to a previously approved merge request...

Insecure Deserialization

temporai is vulnerable to Insecure Deserialization. The vulnerability is caused due to a missing validation/sanitization while deserializing user provided data in function loadfromfile of the component PKL File Handler within utils/serialization.py. An attacker can exploit this remotely to...

Arbitrary File Read

Jenkins Git server Plugin is vulnerable to Information Disclosure. The vulnerability is caused due to a lack of proper input validation in the Git Server Plugin's command parser feature. This allows an attacker with Overall/Read permission to read content from arbitrary files on the Jenkins...

Buffer Overflow

libgpac.so is vulnerable to Buffer overflow. The vulnerability is due to a lack of size validation for the compressorname parameter within the gfisomnewgenericsampledescription function. An attacker can enter an arbitrary size which leads to buffer overflow...

Insecure Deserialization

synthcity is vulnerable to Insecure Deserialization. The vulnerability is caused due to a missing validation/sanitization while deserializing user provided data in the loadfromfile function of the PKL File Handler component within utils/serialization.py...

Inadequate TLS Encryption

github.com/dexidp/dex is vulnerable to Inadequate TLS Encryption. The vulnerability is due to serving HTTS traffic over insecure TLS 1.0 and TLS 1.1, which allows an attacker to eavesdrop on the traffic...

SQL Injection

pimcore/admin-ui-classic-bundle is vulnerable to SQL Injection. The vulnerability is due to missing selectedIds parameter validation. Any backend user with basic permissions can execute arbitrary SQL statements...

Path Traversal

Jenkins Matrix Project Plugin is vulnerable to Path Traversal. The vulnerability is caused due to improper sanitization of user-defined axis names in multi-configuration projects. This could allow an attacker to manipulate or replace the config.xml files with arbitrary content, resulting in Path...

Host Header Injection

pimcore/admin-ui-classic-bundle is vulnerable to Host Header Injection. The vulnerability is due to missing Host header validation. An attacker can a send password change requests to a user, specifying a "Host" header of a website they control, resulting in them receiving the password token,...

Denial Of Service (DoS)

libtiff.so is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to a lack of validation for row parameter in the TIFFReadRGBATileExt function within tifgetimage.c. This flaw allows a remote attacker to pass a crafted TIFF file to which results in improper handling of data, causin...

Denial Of Service (DoS)

libtiff.so is vulnerable to Denial Of Service DoS. The vulnerability is due to the TIFFRasterScanlineSize64 function returning excessively small or large sizes for certain TIFF inputs. This flaw allows a remote attacker to cause a Denial Of Service DoS via a crafted input with a size smaller than...

Denial Of Service (DoS)

github.com/openfga/openfga is vulnerable to Denial Of Service DoS. The vulnerability is due to inefficient memory management in the ListObjects function, particularly in handling the closure of the ReverseExpand channel, resulting in memory being improperly released. This flaw allows an attacker ...

Cross-site Scripting (XSS)

dolibarr/dolibarr is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of sanitization for the key variable in the topmenu function within main.inc.php. This allows an attacker to insert malicious JavaScript code into the key variable resulting in Cross-Site Scripting...

Arbitrary Code Execution

Processwire is vulnerable to Arbitrary Code Execution. The vulnerability is due to the downloadzipurl parameter when installing new modules. which allows an attacker to execute arbitrary code and install a reverse shell...

Improper Access Control

GitLab is vulnerable to Improper Access Control. The vulnerability is caused due to flaws in the implementation of access controls mechanism.This allows an attacker to create a workspace in one group that is associated with an agent from another group...

Insufficient Verification Of Data Authenticity

GitLab CE/EE is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is caused due to an attacker could potentially modify the metadata of signed commits. This can lead to compromising Integrity of the system...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to the formDataToJSON method within lib/helpers/formDataToJSON.js improperly filtering the proto attribute from the FormData object, allowing an attacker to overwrite critical JavaScript Object attributes...

Credential Exposure

Microsoft.Data.SqlClient is vulnerable to Credential Exposure. The vulnerability is due to improper handling of TLS connections, allowing an attacker to read or modify traffic between the server and client. The attacker would have to position themself between the client and server, resulting in...

Arbitrary File Read

org.jenkins-ci.plugins: log-command is vulnerable to Arbitrary File Read. The vulnerability is due to the command parser incorrectly sanitizing the @ character followed by a file path in an argument with the file's contents. This allows an unauthenticated attacker to read arbitrary files on the...

Cleartext Storage Of Sensitive Information

apache-airflow & apache-airflow-providers-cncf-kubernetes are vulnerable to Cleartext Storage Of Sensitive Information. The vulnerability is due to the storage of configuration files without encryption, and plaintext logging of configuration details, allowing an attacker to access the kubernetes...

Improper Authorization

apache-airflow is vulnerable to Improper Authorization. The vulnerability is due to missing access control check while accessing DAG code. An authenticated user can access source code of DAG to which they don't have access to...

Denial Of Service (DoS)

mupdf is vulnerable to Divide By Zero. The vulnerability is caused due to missing float validation in the bmpdecompressrle4 function within load-pnm.c, resulting in a divide by zero exception. This can potentially lead to a Denial of Service DoS attacks...

Denial Of Service (DoS)

mupdf is vulnerable to Divide By Zero. The vulnerability is caused due to missing float validation in the pnmbinaryreadimage function within load-pnm.c, resulting in a divide by zero exception. This can potentially lead to a Denial of Service DoS attacks...

Denial Of Service (DoS)

mupdf is vulnerable to Divide By Zero. The vulnerability is caused due to missing float validation in the computecolor function within jquant2.c, resulting in a divide by zero exception. This can potentially lead to a Denial of Service DoS attacks...

Deserialization Of Untrusted Data

apache-airflow is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to the deserialization of pickle stream when enablexcompickling = False. An attacker can poison XCom data by bypassing the protection of enablexcompickling = False. The vulnerability requires a DAG author...

Cross Site Scripting (XSS)

com.jfinal: jfinal is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper handling of the password parameter within the /admin/login route . This allows attackers to execute arbitrary code via crafted malicious URLs, resulting in Cross-Site Scripting...

Denial Of Service (DoS)

sveltejs/kit is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of HTTP GET and TRACE requests that include a empty body. When such requests are received, the application throws an error stating "Request with GET/HEAD method cannot have body" and subsequently...

Divide-By-Zero

libmupdf.so is vulnerable to Divide-By-Zero. The vulnerability is due fznewpixmapfromfloatdata function within pixmap.c trying to attempts to perform a division operation where the divisor is zero, an operation that is mathematically undefined and can potentially lead to Denial of Service...

Divide-By-Zero

libmupdf.so is vulnerable to Divide-By-Zero. The vulnerability is due to pnmbinaryreadimage function within load-pnm.c there is no proper validation of input PNM image data, leading to incorrect calculations of image parameters. This results in scenarios where the function attempts to divide a...

Path Traversal

Whoogle Search is vulnerable to Path Traversal. The vulnerability is caused due to a lack of validation for the name variable in the config function within app/routes.py. This allows an attacker to perform a limited file write, overwriting existing files or creating new ones...

Cross Site Scripting (XSS)

whooglesearch is vulnerable to Cross Site Scripting XSS. The vulnerability due to improper validation of user-controlled srctype and elementurl variables within requests.py. This flaw allows an attacker to control the HTTP response content type and craft a special URL to point to a malicious...

Server Side Request Forgery (SSRF)

whooglesearch is vulnerable to Server Side Request Forgery. The vulnerability due to the GET request in request.py because there is no validation of the user-controlled srctype and elementurl variables within theelement method in app/routes.py.This flaw allows an attacker to craft a GET requests ...

XML External Entity (XXE)

Spreadsheet::ParseXLSX is vulnerable to XML External Entity XXE. The vulnerability is caused due to neglecting noxxe option of XML::Twig. This can be exploited to compromise Confidentiality of the system...

Incorrect Authorization

GitLab CE/EE is vulnerable to Incorrect Authorization. The vulnerability is caused due to incorrect authorization checks in GitLab CE/EE. This can allow a user to abuse slack/mattermost integrations to execute slash commands as another user...

Path Traversal

@hono/node-server is vulnerable to Path Traversal. The vulnerability is due to improper url string validation in src/request.ts, allowing an attacker to use .. in the request URL to access arbitrary files on the static server...

Prototype Pollution

hoolock is vulnerable to Prototype Pollution. The vulnerability is due to utility functions failing to block attempts to access or alter object prototypes. An attacker can modify application data or perform a Denial of Service by exploiting this vulnerability...

Arbitrary Code Execution

clojure is vulnerable to Arbitrary Code Execution. The vulnerability is due to the server deserializing untrusted objects. Classes can be used to construct serialized object which executes arbitrary code upon deserialization...

Cross Site Scripting (XSS)

labelstudio is vulnerable to Cross Site Scripting XSS. The vulnerability is due to not sanitizing/validating the HTML/JavaScript file that was downloaded from the import data feature from a remote web resource. An attacker can exploit this to download a HTML file that executes malicious JavaScrip...

Arbitrary Code Execution

metagpt is vulnerable to Arbitrary Code Execution. The vulnerability is due to the 'RunCode.runscript function passing shell metacharacters to subprocess.Popen caused by improper prompt santization. A user with the QaEngineer role can execute arbitrary code...

Denial Of Service (DoS)

org.springframework: spring-core is vulnerable to Denial of Service DoS. The vulnerability is due to the mishandling of specially crafted HTTP requests, which can result in Denial of Service DoS. As a prerequisite, Spring MVC and Spring Security must be on the classpath for this vulnerability to ...

Server Side Request Forgery (SSRF)

whooglesearch is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to not sanitizing user-supplied data from the location variable in the window endpoint which passes the same user supplied input to send method within request.py. This can be exploited to send crafted GET...

Expired Pointer Dereference

squid is vulnerable to Expired Pointer Dereference. The vulnerability is due to the usage of a pointer after dereference. An attacker can exploit this vulnerability to mount a Denial Of Service DOS attack against Cache Manager error responses when generating error pages for Client Manager reports...

Cross-site Scripting (XSS)

JFinalcms is vulnerable to Cross-site Scripting XSS. The vulnerability is due to a lack of parameter sanitization which allows attackers to run arbitrary JavaScript code via the /admin/login username parameter...

Command Injection

paddlepaddle is vulnerable to Command Injection. The vulnerability is due to the url parameter being incorporated into the command string without proper validation or sanitization within the wgetdownload function. This allows an attacker to execute arbitrary commands on the host system, utilizing...