SQL Injection

apache-airflow-providers-snowflake is vulnerable to SQL Injection. The vulnerability is due to failure to sanitize special elements due to improper sanitation of table and stage parameters in the CopyFromExternalStageToSnowflakeOperator component...

Sensitive Data Exposure

Infinispan CLI is vulnerable to sensitive data exposure. The vulnerability is due to processing a Base64-decoded Kubernetes secret password in plaintext and including it in a command string, which may expose the data in error messages when a command is not found, allowing attackers to exploit thi...

Server Side Request Forgery (SSRF)

github.com/octo-sts/app is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation and sanitization of OpenID Connect token fields, allowing attackers to craft tokens that trigger internal network requests...

Denial Of Service (DoS)

github.com/openbao/openbao is vulnerable to Denial Of Service DoS. The vulnerability is due to lack of proper authentication and auditing for cancellation operations, allows an attacker to unauthenticatedly cancel root and recovery rekey operations...

Command Injection

ios-simulator-mcp is vulnerable to command injection. The vulnerability is due to unsafe use of Node.js exec with untrusted user input in the uitap tool, which allows attackers to inject shell meta-characters via arguments like duration, udid, x, and y...

DHCP Pool Exhaustion

github.com/lxc/incus is vulnerable to DHCP Pool Exhaustion. The vulnerability is due to improper generation of nftables rules for local services when ACLs are used on devices connected to a bridge, which allows bypassing security.macfiltering, security.ipv4filtering, and security.ipv6filtering...

Security Filter Bypass

github.com/lxc/incus is vulnerable to security filter bypass. The vulnerability is due to incorrect generation of nftables rules when applying ACLs on devices connected to a bridge, which allows ARP spoofing and full spoofing of another VM/container on the same bridge...

Template Injection

PySpur is vulnerable to Template Injection. The vulnerability is due to improper neutralization of special elements due to unsafe handling of the usermessage argument in the SingleLLMCallNode function of the Jinja2 Template Handler component...

XML External Entity (XXE) Injection

Allure is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper XML parser configuration due to insecure settings in the xunit-xml-plugin that allow external entity expansion when processing .xml test result files...

Man-in-the-middle(MitM) Attack

github.com/containers/podman is vulnerable to Man-In-The-Middle MITM attack. The vulnerability is due to lack of TLS certificate verification during the image download process from an OCI registry, allowing an attacker to intercept and modify the VM image data, potentially injecting malicious...

Server Side Request Forgery (SSRF)

langchaincommunity is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to lack of request filtering or validation, which allows the component to send requests to internal or local network addresses...

Session Fixation

Moodle is vulnerable to Session Fixation. The vulnerability is due to improper session management and unauthenticated access to the sesskey parameter, which can be reused in the OAuth2 login flow, allowing attackers to hijack user sessions...

Sensitive Information Disclosure

Umbraco.cms is vulnerable to Sensitive Information Disclosure. The vulnerability is due to insufficient access control to an anonymously accessible endpoint revealing password policy configuration, which may aid brute-force attacks...

Sensitive Information Disclosure

io.quarkus:quarkus-vertx is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper context isolation and data leakage when duplicating an already duplicated Vert.x context, potentially exposing sensitive information like request scope, security details, and metadata...

Signature Spoofing

pbkdf2 is vulnerable to Signature Spoofing. The vulnerability is due to improper input validation in the lib/to-buffer.js file, which allows an attacker to bypass signature verification and spoof cryptographic signatures, making malicious data appear authentic...

Unauthorized Access

Claude Code is vulnerable to Unauthorized Access. The vulnerability is due to improper origin validation due to the extensions accepting WebSocket connections from attacker-controlled webpages, allowing unauthorized access to IDE data and limited code execution in specific scenarios...

Privilege Escalation

k8s.io/kubernetes is vulnerable to Privilege escalation. The vulnerability is due to missing authorization checks during pod creation for dynamic resource claims, allowing a compromised node to create mirror pods that access unauthorized resources...

Improper Signature Verification

rfc3161-client is vulnerable to Improper Signature Verification. The vulnerability is due to insufficient signature validation due to failure to verify the Timestamp Response TSR signature against the timestamping leaf certificate, allowing attackers to forge signatures that appear valid if the...

Server Side Request Forgery (SSRF)

mlflow is vulnerable to missing input validation. The vulnerability is due to missing validation of the gatewaypath parameter in the gatewayproxyhandler function, allowing an attacker to manipulate the request path to access unintended internal endpoints or services...

Improper Access Control

Mattermost is vulnerable to Improper Access Control. The vulnerability is due to inadequate enforcement of channel member management permissions due to a flaw in how playbook run participants are handled when linked to channels, allowing unauthorized user modifications...

Remote Code Execution (RCE)

CrafterCMS is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper control of dynamically-managed code resources due to a Groovy Sandbox bypass that allows authenticated developers to execute OS commands...

Sensitive Information Disclosure

sentry-android is vulnerable to Sensitive Information Disclosure. The vulnerability is due to inadequate data masking of sensitive data appearing in Jetpack Compose text composables during Android session replays under specific configurations...

Cross-Site Scripting (XSS)

changedetectionio is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input sanitization of filter errors in website page change detection watches, allows an attacker to inject and execute malicious scripts in the context of a victim's browser...

Signature Spoofing

pbkdf2 is vulnerable to Signature Spoofing. The vulnerability is due to improper validation of input parameters within the pbkdf2 library, allows an attacker to forge or spoof digital signatures, potentially bypassing authentication or integrity checks...

Host Header Injection

github.com/go-chi/chi is vulnerable to host header injection. The vulnerability is due to improper validation of the Host header in the RedirectSlashes function, allowing an attacker to manipulate redirects...

Remote Code Execution (RCE)

github.com/mattermost/mattermost-server is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper sanitization of filenames in uploaded archive files, which allows path traversal sequences to be processed during extraction...

Unauthorized Access

github.com/mattermost/mattermost-server is vulnerable to unauthorized access. The vulnerability is due to improper access control caused by a failure to correctly retrieve and validate requestorInfo for guest users, allowing attackers to access playbook runs without proper authorization...

Login IP Filter Bypass

DNN.PLATFORM is vulnerable to login IP filter bypass. The vulnerability is due to the ability to craft a special request or proxy, which allows an attacker to bypass IP-based access controls and perform unauthorized login attempts from disallowed IP addresses...

Cross-Site Scripting (XSS)

dnn.platform is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input validation and sanitization in the Activity Feed Attachments endpoint, allowing malicious scripts to be injected and rendered...

Missing Authentication For Critical Function

Apache SeaTunnel is vulnerable to Missing Authentication For Critical Function. The vulnerability is due to insufficient access control and improper input validation due to unauthorized access to the /hazelcast/rest/maps/submit-job endpoint, allowing attackers to exploit the MySQL URL parameters...

Cross-Site Scripting (XSS)

DNN.PLATFORM is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient validation in the TokenReplace function and SkinObjects, which fail to handle specially crafted URLs, allowing attackers to inject and execute arbitrary scripts in the user's browser...

Regular Expression Denial Of Service (ReDoS)

PowSyBl is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression handling due to unvalidated user-supplied regex being compiled and evaluated in the RegexCriterion class...

Privilege Escalation

www.velocidex.com/golang/velociraptor is vulnerable to Privilege Escalation The vulnerability is due to the failure to enforce required permissions on the Admin.Client.UpdateClientConfig artifact, allowing users with COLLECTCLIENT permissions to update client configurations and potentially execut...

NTLM Hash Exposure

dnn.platform is vulnerable to NTLM hash exposure. The vulnerability is due to improper handling of authentication requests, allowing malicious interactions to redirect NTLM authentication hashes to an attacker-controlled SMB server...

Arbitrary Code Execution (ACE)

pterodactyl/panel is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to improper handling of the /locales/locale.json endpoint with locale and namespace query parameters, allowing unauthenticated attackers to execute arbitrary code...

Regular Expression Denial Of Service (ReDoS)

com.powsybl, powsybl-commons is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regex handling causing excessive backtracking, which allows an attacker to trigger high CPU usage and potentially crash or slow down the system...

Deserialization Of Untrusted Data

com.powsybl, powsybl-math is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper handling of serialized data in the SparseMatrix.read method, which allows malicious input to be deserialized in an unsafe manner...

Path Traversal

DotVVM is vulnerable to Path Traversal. The vulnerability is due to insufficient input validation allowing the attacker to access the arbitrary files when a FileResourceLocation is used and the application is running in Debug mode...

Path Traversal

pythona2a is vulnerable to Path traversal. The vulnerability is due to improper validation or sanitization of user-supplied file paths in the createworkflow function, allows an attacker to access arbitrary files on the server by crafting malicious input that traverses directories...

XML External Entity (XXE) Injection

PowSyBl is vulnerable to XML External Entity XXE. The vulnerability is due to the use of untrusted XML input in the XmlReader class, which can be exploited to read arbitrary files or perform unauthorized network requests...

Cross-Site Scripting (XSS)

Mezzanine CMS is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the displayablelinksjs function, allowing attackers to inject malicious JavaScript into blog post titles that executes in another admin's browser...

Remote Authentication Bypass

github.com/gravitational/teleport is vulnerable to remote authentication bypass. The vulnerability is due to a flaw in the authentication mechanism that improperly handles or validates user credentials or session data, allowing an attacker to gain unauthorized access to infrastructure systems...

Denial Of Service (DoS)

Apache Tomcat is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient enforcement of resource limits or throttling mechanisms in Apache Tomcat when handling client requests, allows an attacker to exhaust system resources by sending excessive or continuous requests,...

Authentication Bypass

Apache Tomcat is vulnerable to Authentication Bypass. The vulnerability is due to improper handling of resource mounting paths PreResources or PostResources in Apache Tomcat, which allows access to resources via alternate, unprotected paths...

Server Side Request Forgery (SSRF)

@opennextjs/cloudflare is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to an unimplemented feature in the Cloudflare adapter for Open Next, allows unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

Denial Of Service (DoS)

Protobuf is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of deeply nested or recursive structures in the Pure-Python backend, leading to a RecursionError...

Improper Access Control

github.com/ubuntu/authd is vulnerable to Improper Access Control. The vulnerability is due to flawed temporary user record handling due to a defect in pre-auth NSS where first-time logins are mistakenly treated as part of the root group during the SSH session...

Denial Of Service (DoS)

org.apache.commons:commons-fileupload2-core is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient resource limiting due to the allocation of resources for multipart headers without proper bounds, allowing attackers to exhaust system resources...

Directory Traversal

openc3-cosmos-tool-iframe is vulnerable to Directory Traversal. The vulnerability is due to improper input validation and insufficient sanitization of user-supplied input in the openc3-api/tables endpoint, allowing attackers to traverse directories and access unauthorized files...

Denial Of Service (DoS)

Liferay Portal is vulnerable to Denial Of Service DoS. The vulnerability is due to unrestricted saving of request parameters in the HTTP session, which allows remote attackers to consume system memory via crafted HTTP requests...