Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to attacker-controlled query input being reflected into raw HTML without proper output encoding, which allows an unauthenticated attacker to inject malicious scripts through a crafted query and execute them in ...

Open Redirect

Semantic MediaWiki is vulnerable to Open Redirect. The vulnerability is due to insufficient validation of the user-controlled subpage when generating HTTP redirects, which allows an attacker to redirect victims from a trusted wiki URL to an attacker-controlled external host for phishing or...

Concurrent Execution Using Shared Resource With Improper Synchronization

Paymenter is vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization. The vulnerability is due to missing transactional locking when processing concurrent service downgrade requests, which allows an authenticated attacker to submit multiple simultaneous requests and...

Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient output-context encoding of the user-controlled value parameter in rendered output and error messages, which allows an attacker to inject malicious content and execute scripts in a victim's brows...

Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of user-controlled mainlabel content when headers=plain, which allows an attacker to inject executable HTML into table headers and execute malicious scripts in a victim's browser...

Cross-site Scripting (XSS)

Paella Player is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of closed-caption cue text, which allows an attacker to inject malicious script content through captions and execute it in a victim's browser...

Cross-site Scripting (XSS)

Spring Authorization Server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to user-controlled values being rendered without HTML entity encoding in the default consent page, which allows an attacker to inject malicious content through a crafted OAuth2 authorization request an...

Exposure Of Sensitive Information Through Log Files

Spring Cloud Stream is vulnerable to Exposure of Sensitive Information Through Log Files. The vulnerability is due to sensitive data potentially being included in application logs, which allows an attacker with access to the log files to obtain sensitive information...

SQL Injection

CakePHP is vulnerable to SQL Injection. The vulnerability is due to insufficient validation and escaping of user-controlled dataType, part, and unit values used in generated SQL statements, which allows an attacker to inject malicious SQL queries and potentially access, modify, or delete database...

Improper Privilege Management

Grav is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient access restrictions on the access field in the core group blueprint, which allows a delegated admin.users operator to grant themselves super-admin privileges and gain access to scheduler and Twig...

Exposure Of Sensitive Information

Grav is vulnerable to Exposure of Sensitive Information. The vulnerability is due to an incomplete default denylist in the Twig sandbox that fails to restrict access to system configuration secrets, which allows an attacker with page-edit permissions to use config.get or config.toArray to retriev...

Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper detection of event handlers when unpaired quotes are used in unquoted HTML attribute values, which allows an authenticated editor to bypass validation, inject malicious event handlers such as onerror=, and execut...

Arbitrary Code Injection

Grav CMS is vulnerable to Arbitrary Code Injection. The vulnerability is due to insufficient validation of uploaded ZIP archives in the Flex Objects plugin, which allows an authenticated attacker to bypass filename validation, upload malicious PHP files to the web root, and execute arbitrary code...

Cross-site Scripting (XSS)

Grav is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of invalid UTF-8 bytes in the XSS detection function, which allows an authenticated attacker with page-edit permissions to bypass the XSS safety check, store malicious JavaScript, and execute it in a...

Path Traversal

Grav is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of directory paths in MediaUploadTrait::deleteFile, which allows an authenticated attacker with media management permissions to use ../ sequences to delete arbitrary files outside the intended media storage...

Arbitrary Code Injection

Grav is vulnerable to Arbitrary Code Injection. The vulnerability is due to incomplete validation of dynamic-data bare functions using a denylist instead of an allowlist, which allows an attacker with page-edit or blueprint-config access to invoke errorlog, write malicious PHP payloads to...

Path Traversal

Grav is vulnerable to Path Traversal. The vulnerability is due to improper directory-boundary validation in the static asset server, which allows an unauthenticated attacker to exploit path prefix matching and access files from sibling directories outside the configured asset directory...

Path Traversal

Grav CMS is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of filesystem paths in the mediadirectory Twig function, which allows an authenticated attacker with page authoring privileges to access and read files outside the intended media directory that match...

Exposure Of Sensitive Information

Grav is vulnerable to Exposure of Sensitive Information The vulnerability is due to insufficient field filtering in the allow-listed offsetGet and offsetExists methods for User objects, which allows an attacker with page-edit permissions to access sensitive fields such as password hashes and 2FA...

Server-Side Request Forgery (SSRF)

io.kestra, core is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled HTTP URI destinations, which allows an unauthenticated attacker to import and execute a flow that makes requests to internal services, loopback/link-local...

Memory Exhaustion

com.rabbitmq, amqp-client is vulnerable to a memory exhaustion. The vulnerability is due to the client disabling the configured limit when the negotiated frameMax value is zero, which allows an attacker controlling a malicious AMQP server or performing a man-in-the-middle attack to inject oversiz...

Server-Side Request Forgery (SSRF)

Nuxt OG Image is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled font URLs before performing server-side requests, which allows an unauthenticated attacker to access internal services such as loopback, private, link-local,...

OS Command Injection

@cyclonedx/cyclonedx-npm is vulnerable to OS Command Injection. The vulnerability is due to improper sanitization of the untrusted --workspace value when constructing a Windows shell command, which allows an attacker to inject shell metacharacters and execute arbitrary operating-system commands...

Authentication Bypass

Apache CXF is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of required claims in self-issued OIDC ID tokens, including issuer, subject, audience, time, and subjwk binding, which allows an attacker to craft malicious tokens and bypass authentication when...

Improper Certificate Validation

Apache HttpComponents Client is vulnerable to Improper Certificate Validation. The vulnerability is due to the HostnameVerificationPolicyBUILTIN setting being ineffective in the asynchronous HttpClient, which allows an attacker capable of intercepting and modifying traffic to impersonate the...

LDAP Injection

centraldogma-server-auth-shiro is vulnerable to LDAP Injection. The vulnerability is due to insufficient sanitization of the login username before inserting it into an LDAP search filter, which allows an unauthenticated attacker to inject LDAP filter metacharacters, manipulate authentication...

Use Of Hard-coded Credentials

centraldogma-server is vulnerable to Use of Hard-coded Credentials.The vulnerability is due to the server falling back to a publicly known hard-coded secret when replication.secret is not configured, which allows an attacker with network access to authenticate to the embedded ZooKeeper ensemble,...

OS Command Injection

OmniRoute is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of attacker-controlled binary and versionCommand values before executing them with execFileSync, which allows an unauthenticated attacker under certain configurations to supply interpreter...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to revoked access and refresh tokens remaining valid and being reported as active by the token introspection service, which allows an attacker to continue using revoked tokens to access protected resources...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to a flaw in the removeCodeGrant functionality that allows authorization codes to remain reusable, which allows an attacker who captures a valid authorization code to redeem it multiple times and obtain multiple valid...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to JwtRequestCodeFilter copying security-sensitive claims from a signed request JWT into the authorization parameter map without proper validation, which allows an attacker with a validly signed JWT to replace...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to the OAuth2 Dynamic Client Registration endpoint accepting and storing client-supplied scope values without validating them against an allowed scope list, which allows an attacker to self-assign privileged scopes durin...

Time-of-Check Time-of-Use (TOCTOU)

Apache CXF is vulnerable to Time-of-Check Time-of-Use TOCTOU. The vulnerability is due to a race condition in JCacheCodeDataProvider that allows the same authorization code to be redeemed concurrently, which allows an attacker to obtain multiple distinct and valid access tokens from a single...

Deserialization Of Untrusted Data

Apache CXF is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to native Java deserialization of inbound JMS ObjectMessage objects without type restrictions, which allows an attacker who can place messages on the JMS destination to submit malicious serialized objects that...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to failure to validate the chash parameter when it is omitted by a non-compliant or misconfigured Identity Provider, which allows an attacker to substitute or inject an authorization code and potentially gain...

Improper Filtering Of HTTP Headers

Spring Cloud Function is vulnerable to improper filtering of HTTP headers. The vulnerability is due to insufficient validation and filtering of HTTP headers, which allows an attacker to send specially crafted HTTP requests containing malicious or unexpected headers and potentially influence...

Cross-site Scripting (XSS)

Spring Framework is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper HTML escaping when rendering field errors obtained through the no-argument Errors.getFieldErrors or Errors.getFieldError accessors, which allows an attacker to inject arbitrary HTML or JavaScript code...

Server-Side Request Forgery (SSRF)

GeoNetwork is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of caller-supplied WMS server URLs, which allows an attacker to make the server send requests to internal hosts and potentially disclose internal data, bypass authorization, or perfor...

Directory Traversal

Spring Framework is vulnerable to Directory Traversal. The vulnerability is due to improper validation of untrusted view names when using SpringTemplateLoader for FreeMarker template resolution, which allows an attacker to manipulate the view name and access files outside the intended template...

Insecure File Permissions

PropertiesPersistingMetadataStore is vulnerable to insecure file permissions. The vulnerability is due to the metadata store persisting its state in a world-readable properties file under $java.io.tmpdir/spring-integration/metadata-store.properties, which allows a local attacker to read the file...

Improper Input Validation

org.springframework.cloud, spring-cloud-context is vulnerable to improper input validation. The vulnerability is due to the absence of property-key allow-list validation, which allows an attacker with access to the writable /actuator/env endpoint to inject or modify arbitrary environment properti...

Safety Guard Bypass

Spring Framework is vulnerable to a safety guard bypass. The vulnerability is due to improper enforcement of security restrictions during compiled SpEL expression evaluation, which allows an attacker to bypass the intended safety protections and execute expressions with capabilities that should...

Denial-of-Service (DoS)

Spring Framework is vulnerable to a Denial-of-Service DoS. The vulnerability is due to insufficient validation of user-supplied property paths during data binding, which allows an attacker to submit specially crafted property paths that consume excessive resources and potentially cause the...

SQL Injection

Apache Hive is vulnerable to SQL Injection. The vulnerability is due to unsanitized partition names being concatenated into direct SQL queries, allowing an authenticated user to alter partition lookups and read, modify, truncate, or affect unintended partition metadata...

Improper Authentication

Spring Security is vulnerable to Improper Authentication. The vulnerability is due to user verification state not being properly maintained with a distributed HTTP session store, allowing an attacker to bypass WebAuthn user verification...

Improper Caching

Spring Cloud Stream is vulnerable to improper caching of the original content type. The vulnerability is due to the Avro handling component caching the original content type, where the cached value is reused for subsequent messages and an attacker can supply a crafted content type to cause...

Denial Of Service (DoS)

Spring AI is vulnerable to Denial of Service DoS. The vulnerability is due to the MCP Streamable HTTP server transport retaining an unbounded number of unauthenticated sessions, which allows a remote attacker to exhaust server memory over time and ultimately cause a denial of service affecting...

Improper Input Validation

Spring Integration is vulnerable to Improper Input Validation. The vulnerability is due to a non-thread-safe ScriptEngine instance being reused across concurrent message processing, potentially causing message data leakage between script evaluations or spurious exceptions...

HTTP Response Splitting

Spring Framework is vulnerable to HTTP response splitting. The vulnerability is due to building a Content-Disposition header value from untrusted input, where the input file name is used without proper sanitization and attackers can supply a malicious file name containing CRLF characters to split...

Improper Preservation Of Message Metadata

Spring Integration is vulnerable to improper preservation of message metadata. The vulnerability is due to reply and propagated headers being copied from the most recently consumed upstream message when .fluxTransform processes raw payloads asynchronously or out of order, which allows an attacker...