Improper Restriction Of Rendered UI Layers Or Frames

@haxtheweb/haxcms-nodejs is vulnerable to Improper Restriction of Rendered UI Layers or Frames. The vulnerability is due to lack of validation or sanitization of user-supplied URLs in iframe website blocks via malicious iframe embedding, allowing attackers to embed attacker-controlled sites and...

OS Command Injection

@haxtheweb/haxcms-nodejs is vulnerable to OS command injection. The vulnerability is due to insufficient input validation in the gitImportSite functionality, which allows attacker-controlled input to reach the procopen function through a crafted URL string...

Denial Of Service (DoS)

github.com/pion/interceptor is vulnerable to Denial of Service DoS. The vulnerability is due to improper input validation in the RTP packet factory that fails to correctly validate padding length, allowing crafted RTP packets to trigger a panic in Pion-based SFUs...

Environment Variable Exposure

github.com/knadh/listmonk is vulnerable to Environment Variable Exposure. The vulnerability is due to the use of env and expandenv template functions in Sprig, which allows non-super-admin users to capture sensitive environment variables in multi-user installations...

Regular Expression Denial Of Service (ReDoS)

@vue/cli-plugin-pwa is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to unsafe regex handling in the HtmlPwaPlugin component of the Markdown code handler, which can be exploited remotely to degrade performance...

Denial Of Service (DoS)

github.com/kuadrant/authorino is vulnerable to Denial of Service DoS. The vulnerability is due to the lack of limits on post-authorization callbacks, allowing an attacker with developer persona access to overload the service...

Regular Expression Denial Of Service (ReDoS)

taro-css-to-react-native is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression complexity due to unsafe regex processing in css-to-react-native/src/index.js, which may be exploited remotely to cause performance degradation...

Denial Of Service (DoS)

github.com/kuadrant/authorino is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient access control or privilege enforcement, allowing an attacker to disrupt or shut down the Authorino service, blocking the evaluation of all authentication policies on the cluster...

Deserialization Of Untrusted Data

org.apache.inlong, inlong-manager is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Improper handling of input parameter, which allows an authenticated attacker to read arbitrary files on the server by exploiting the deserialization flaw through crafted input...

Cross-Site Scripting (XSS)

barryvdh/laravel-translation-manager is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to incorrect input validation and sanitization of user-input data, allowing attackers to inject arbitrary HTML or JavaScript code...

Ttemplate Injection

skyvern is vulnerable to Template injection . The vulnerability is due to improper handling of Jinja templates in sdk/workflow/models/block.py, which allows unintended data to be exposed at runtime...

Local File Inclusion (LFI)

elmsln/haxcms is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper input validation in the saveOutline endpoint, allowing low-privileged authenticated users to manipulate the location field in site.json and access arbitrary files on the server...

Cross-Site Scripting (XSS)

elmsln/haxcms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization in the saveNode and saveManifest endpoints, allowing arbitrary JavaScript execution through non-script HTML tags stored in the site's JSON schema...

Arbitrary Code Injection

org.hibernate.validator:hibernate-validator is vulnerable to Arbitrary Code Injection. The vulnerability is due to expression language injection due to interpolation of user-supplied input in constraint violation messages using Expression Language, which may allow attackers to access sensitive da...

Log Injection

Django is vulnerable to log injection. The vulnerability is due to unescaped user input in request.path during internal HTTP response logging, allowing attackers to manipulate logs, forge entries, or hide malicious activity...

Insertion Of Sensitive Information Into Log Files

com.erudika, para-server is vulnerable to Insertion Of Sensitive Information Into Log Files. The vulnerability is due to logging full request URLs, including sensitive access tokens, in WARN-level logs during failed Facebook profile requests. It allows an attacker with access to the logs or log...

Cross-site WebSocket Hijacking

webpack-dev-server is vulnerable to Cross-site WebSocket hijacking. The vulnerability is due to improper Origin header validation, which permits IP address origins, allows attackers to hijack WebSocket connections and steal source code via malicious websites...

Denial Of Service (DoS)

github.com/coredns/coredns is vulnerable to Denial of Service DoS. The vulnerability is due to lack of limits on concurrent QUIC streams and goroutines per connection, allowing an attacker to exhaust memory by opening many streams simultaneously...

Authorization Bypass

github.com/authzed/spicedb is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of caveated branches during permission checks in schemas with caveats on arrow’ed relations, allowing an attacker to deny legitimate access and disrupt authorized operations for valid...

Information Disclosure

com.fasterxml.jackson.core, jackson-core is vulnerable to information disclosure. The vulnerability is due to incorrect handling of byte array offsets in the JsonLocation.appendSourceDesc method, causing exception messages to leak unintended memory content, allows an attacker to access sensitive...

SQL Injection

llamaindex is vulnerable to SQL Injection. The vulnerability is due to SQL injection due to improper handling of user input in multiple vector store integrations, allowing attackers to manipulate SQL queries and access or modify unauthorized data...

Timing Side-channel Attack

signxml is vulnerable to a Timing side-channel attack. The vulnerability is due to information leakage during HMAC comparison when requirex509=False and hmackey is used, allowing attackers to infer the correct HMAC...

Algorithm Confusion

signxml is vulnerable to an Algorithm Confusion. The vulnerability is due to Improper enforcement of signature algorithm restrictions are not properly enforced when hmackey is set and requirex509 is disabled, allowing an attacker to bypass verification by using a different signing algorithm inste...

Arbitrary File Upload

xyz.erupt, erupt is vulnerable to arbitrary file upload. The vulnerability is due to improper validation in the /upload/GoodsCategory/image component, allowing attackers to upload crafted files and execute arbitrary code...

Sensitive Information Disclosure

yiisoft/yii2-redis is vulnerable to Sensitive Information Disclosure. The vulnerability is due to information disclosure due to authentication credentials username and password being logged in plain text during failed connection attempts...

Denial Of Service (DoS)

Multer is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of file upload requests with empty string field names, allowing an attacker to crash the server with a crafted request...

Unauthorized Information Disclosure

@haxtheweb/open-apis is vulnerable to unauthenticated information disclosure. The vulnerability is due to improper access control on the haxPsuUsage API endpoint, allowing remote unauthenticated users to retrieve a list of PSU websites hosted on HAX CMS...

Unauthenticated Remote Code Execution (RCE)

github.com/kro-run/kro is vulnerable to Unauthenticated Remote code execution RCE. The vulnerability is due to a confused-deputy scenario, where users with permission to create or modify ResourceGraphDefinition resources can supply arbitrary container images that kro's controllers deploy and run ...

Deserialization Of Untrusted Data

auth0/auth0-php is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to insecure deserialization due to the SDK processing untrusted cookie data without authentication, allowing attackers to inject malicious serialized payloads...

Sensitive Information Disclosure

@auth0/nextjs-auth0 is vulnerable to Sensitive Information Disclosure. The vulnerability is due to missing cache control headers due to session cookies being cached by CDNs, potentially exposing sensitive session information to unauthorized users...

Unauthorized Configuration Manipulation

Jupyter Core is vulnerable to Unauthorized Configuration Manipulation. The vulnerability is due to improper access control on the %PROGRAMDATA% directory, allowing unprivileged users to write configuration files that affect other users on shared Windows systems...

Exposed Dangerous Method Or Function

webpack-dev-server is vulnerable to source code exposure. The vulnerability is due to lack of proper origin checks due to requests for classic scripts not being subject to the same-origin policy, allowing attackers to inject malicious scripts that extract source code if the port and script path a...

Path Traversal

Python tarfile module is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths during extraction with TarFile.extractall or TarFile.extract when using the filter="data" or filter="tar" parameter, which allows an attacker to craft a malicious tar archive that...

Cross-site Scripting (XSS)

github.com/forceu/gokapi is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the API key renaming feature, which allowed authenticated users to inject JavaScript that would execute when another user accessed the API tab...

Path Traversal

astrbot is vulnerable to a Path Traversal. The vulnerability is due to improper validation or sanitization of file path inputs, allowing attackers to access files outside the intended directories...

Improper File Validation

umbraco.cms is vulnerable to improper file validation. The vulnerability is due to insufficient checks on uploaded file extensions, allowing bypass of configured restrictions via manipulated API requests...

Privilege Escalation

org.wso2.am, am-parent, org.wso2.is, identity-server-parent are vulnerable to privilege escalation. The vulnerability is due to improper validation and access control in the SOAP admin services, which allows attackers to assign elevated privileges to self-registered users under specific deploymen...

Improper Input Validation

github.com/fabiolb/fabio is vulnerable to Improper Input Validation. The vulnerability is due to insecure header handling due to a flaw in processing hop-by-hop headers, allowing clients to remove or manipulate trusted X-Forwarded headers via the Connection header...

Cross-site Scripting (XSS)

github.com/forceu/gokapi is vulnerable to stored cross-site scripting XSS. The vulnerability is due to insufficient sanitization and validation of filenames with embedded JavaScript, allows an attacker to execute malicious JavaScript code in the context of other users’ browsers...

Null Pointer Dereference

github.com/quic-go/quic-go is vulnerable to a Nil-Pointer Dereference. The vulnerability is due to improper handling of ACKs for path probe packets, where they are crafted and sent by a malicious client in a way that triggers the nil-pointer dereference in the server's loss recovery logic, It...

Directory Traversal

tar-fs is vulnerable to Directory traversal. The vulnerability is due to improper path validation during tarball extraction, allowing attackers to write files outside the target directory and potentially overwrite system files or inject malicious content...

Sensitive Data Exposure

django-helpdesk is vulnerable to Sensitive Data Exposure. The vulnerability is due to insecure file permission settings due to os.umask0 in models.py, allows an attacker to access sensitive files or data that should be protected...

Improper Authentication

Mattermost is vulnerable to Improper Authentication. The vulnerability is due to insecure OAuth credential handling due to failure to clear Google OAuth credentials when converting user accounts to bot accounts, enabling unauthorized access via the Google OAuth signup flow...

Server-Side Request Forgery (SSRF)

mcp-markdownify-server is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper input validation due to the Markdownify.get function allowing attacker-controlled URLs to be fetched and their responses read via conversion tools like webpage-to-markdown,...

Improper Token Invalidation

github.com/mattermost/mattermost-server is vulnerable to improper token invalidation. The vulnerability is due to failure to invalidate personal access tokens upon user deactivation, allowing continued access through previously issued tokens...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of access restrictions, which allows guest users to access metadata about members of public channels via the channel members API endpoint...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of access restrictions for System Manager roles, allowing users to access unauthorized team details via direct API requests even when configured with 'No access' ...

Information Disclosure

com.erudika, para-server is vulnerable to Information disclosure. The vulnerability is due to unredacted logging of access and secret keys during variable assignment, which is unnecessary for debugging or system health, allows an attacker with access to the logs to obtain sensitive credentials...

Improper Handling Of Case Sensitivity

org.apache.tomcat, tomcat-catalina is vulnerable to improper handling of case sensitivity. The vulnerability is due to inconsistent case sensitivity handling in the pathInfo component of URIs mapped to the CGI servlet, which allows security constraints to be bypassed...

SQL Injection

Apache Superset is vulnerable to SQL injection. The vulnerability is due to improper input handling in the sqlExpression fields, allowing attackers to inject sub-queries and bypass row-level security...