Arbitrary File Read

org.apache.kafka, kafka-clients is vulnerable to Arbitrary File Read. The vulnerability is due to the lack of proper validation and restriction on the sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url configuration fields, which allows the use of arbitrary URLs, including...

Denial Of Service (DoS)

org.apache.kafka, kafka-clients is vulnerable to Denial Of Service DoS. The vulnerability is due to insecure SASL JAAS JndiLoginModule configuration in the Kafka Connect API and brokers, which allows attackers with AlterConfigs permission to exploit the system...

Remote Code Execution (RCE)

.NET is vulnerable to Remote Code Execution RCE. The vulnerability is due to insecure file handling due to the ability of an attacker to place files in specific locations that can trigger execution of unintended code...

LDAP Injection

Mattermost is vulnerable to LDAP Injection. The vulnerability is due to improper validation due to failure to sanitize LDAP group ID attributes in the /api/v4/ldap/groups/remoteid/link API when objectGUID is used as the Group ID Attribute...

Unauthorized Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Unauthorized Information Disclosure. The vulnerability is due to insufficient restriction of API access, allowing guest users to view information about public teams they are not members of via direct API calls...

Remote Code Execution (RCE)

org.apache.kafka, kafka is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation and unrestricted setting of the sasl.jaas.config property in Kafka Connect configurations, which allows an attacker to specify malicious LDAP login modules that trigger unsafe Java...

Low-order Point Validation Failure

github.com/cloudflare/circl is vulnerable to low-order point validation failure. The vulnerability is due to the failure to validate user-supplied low-order points during the Diffie-Hellman key exchange, which can allow attackers to force the identity point and compromise session security...

Regular Expression Denial Of Service (ReDoS)

brace-expansion is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient handling of complex or nested patterns in regular expressions within the expand function of the file index.js, allows an attacker to remotely cause excessive resource consumption...

Incorrect Access Control

Erxes is vulnerable to Incorrect Access Control. The vulnerability is due to authentication bypass due to improper validation of the User HTTP header, allowing attackers to impersonate users and access any GraphQL endpoint...

Path Traversal

Erxes is vulnerable to Path Traversal. The vulnerability is due to improper input validation due to insufficient sanitization of file paths in the importHistoriesCreate GraphQL mutation handler, allowing authenticated attackers to write to arbitrary files...

Remote Code Execution (RCE)

Nautobot is vulnerable to Remote Code Execution. The vulnerability is due to insufficient sandboxing due to improper security configuration of the Jinja2 templating feature, allowing malicious users to access secrets or call Python APIs to modify data, bypassing object permissions...

Denial Of Service (DoS)

octoprint is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of malformed multipart/form-data requests due to an endless loop triggered by a missing end boundary, which causes the single-threaded Tornado web server to become unresponsive...

Arbitrary File Exfiltration

octoprint is vulnerable to Arbitrary file exfiltration. The vulnerability is due to insufficient restrictions on file movement by users with FILEUPLOAD permission, allowing files readable by OctoPrint to be moved into the upload folder and downloaded...

Path Traversal

Erxes is vulnerable to a Path Traversal. The vulnerability is due to improper validation in the /read-file endpoint handler, allowing an unauthenticated attacker to read arbitrary files from the system...

Unauthorized Access To Uploaded Media Files

Nautobot is vulnerable to unauthorized access to uploaded media files. The vulnerability is due to improper access control on the file-serving endpoint, allowing attackers to access and download sensitive files without authentication by guessing or knowing their URLs...

Credential Leakage

Requests is vulnerable to credential leakage. The vulnerability is due to a URL parsing issue that may expose .netrc credentials to third parties for specially crafted URLs, allowing attackers to exfiltrate sensitive authentication data...

Improper Restriction Of Rendered UI Layers Or Frames

@haxtheweb/haxcms-nodejs is vulnerable to Improper Restriction of Rendered UI Layers or Frames. The vulnerability is due to lack of validation or sanitization of user-supplied URLs in iframe website blocks via malicious iframe embedding, allowing attackers to embed attacker-controlled sites and...

OS Command Injection

@haxtheweb/haxcms-nodejs is vulnerable to OS command injection. The vulnerability is due to insufficient input validation in the gitImportSite functionality, which allows attacker-controlled input to reach the procopen function through a crafted URL string...

Denial Of Service (DoS)

github.com/pion/interceptor is vulnerable to Denial of Service DoS. The vulnerability is due to improper input validation in the RTP packet factory that fails to correctly validate padding length, allowing crafted RTP packets to trigger a panic in Pion-based SFUs...

Environment Variable Exposure

github.com/knadh/listmonk is vulnerable to Environment Variable Exposure. The vulnerability is due to the use of env and expandenv template functions in Sprig, which allows non-super-admin users to capture sensitive environment variables in multi-user installations...

Regular Expression Denial Of Service (ReDoS)

@vue/cli-plugin-pwa is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to unsafe regex handling in the HtmlPwaPlugin component of the Markdown code handler, which can be exploited remotely to degrade performance...

Denial Of Service (DoS)

github.com/kuadrant/authorino is vulnerable to Denial of Service DoS. The vulnerability is due to the lack of limits on post-authorization callbacks, allowing an attacker with developer persona access to overload the service...

Regular Expression Denial Of Service (ReDoS)

taro-css-to-react-native is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expression complexity due to unsafe regex processing in css-to-react-native/src/index.js, which may be exploited remotely to cause performance degradation...

Denial Of Service (DoS)

github.com/kuadrant/authorino is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient access control or privilege enforcement, allowing an attacker to disrupt or shut down the Authorino service, blocking the evaluation of all authentication policies on the cluster...

Deserialization Of Untrusted Data

org.apache.inlong, inlong-manager is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Improper handling of input parameter, which allows an authenticated attacker to read arbitrary files on the server by exploiting the deserialization flaw through crafted input...

Cross-Site Scripting (XSS)

barryvdh/laravel-translation-manager is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to incorrect input validation and sanitization of user-input data, allowing attackers to inject arbitrary HTML or JavaScript code...

Ttemplate Injection

skyvern is vulnerable to Template injection . The vulnerability is due to improper handling of Jinja templates in sdk/workflow/models/block.py, which allows unintended data to be exposed at runtime...

Local File Inclusion (LFI)

elmsln/haxcms is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper input validation in the saveOutline endpoint, allowing low-privileged authenticated users to manipulate the location field in site.json and access arbitrary files on the server...

Cross-Site Scripting (XSS)

elmsln/haxcms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization in the saveNode and saveManifest endpoints, allowing arbitrary JavaScript execution through non-script HTML tags stored in the site's JSON schema...

Arbitrary Code Injection

org.hibernate.validator:hibernate-validator is vulnerable to Arbitrary Code Injection. The vulnerability is due to expression language injection due to interpolation of user-supplied input in constraint violation messages using Expression Language, which may allow attackers to access sensitive da...

Log Injection

Django is vulnerable to log injection. The vulnerability is due to unescaped user input in request.path during internal HTTP response logging, allowing attackers to manipulate logs, forge entries, or hide malicious activity...

Insertion Of Sensitive Information Into Log Files

com.erudika, para-server is vulnerable to Insertion Of Sensitive Information Into Log Files. The vulnerability is due to logging full request URLs, including sensitive access tokens, in WARN-level logs during failed Facebook profile requests. It allows an attacker with access to the logs or log...

Cross-site WebSocket Hijacking

webpack-dev-server is vulnerable to Cross-site WebSocket hijacking. The vulnerability is due to improper Origin header validation, which permits IP address origins, allows attackers to hijack WebSocket connections and steal source code via malicious websites...

Denial Of Service (DoS)

github.com/coredns/coredns is vulnerable to Denial of Service DoS. The vulnerability is due to lack of limits on concurrent QUIC streams and goroutines per connection, allowing an attacker to exhaust memory by opening many streams simultaneously...

Authorization Bypass

github.com/authzed/spicedb is vulnerable to Authorization Bypass. The vulnerability is due to improper handling of caveated branches during permission checks in schemas with caveats on arrow’ed relations, allowing an attacker to deny legitimate access and disrupt authorized operations for valid...

Information Disclosure

com.fasterxml.jackson.core, jackson-core is vulnerable to information disclosure. The vulnerability is due to incorrect handling of byte array offsets in the JsonLocation.appendSourceDesc method, causing exception messages to leak unintended memory content, allows an attacker to access sensitive...

SQL Injection

llamaindex is vulnerable to SQL Injection. The vulnerability is due to SQL injection due to improper handling of user input in multiple vector store integrations, allowing attackers to manipulate SQL queries and access or modify unauthorized data...

Timing Side-channel Attack

signxml is vulnerable to a Timing side-channel attack. The vulnerability is due to information leakage during HMAC comparison when requirex509=False and hmackey is used, allowing attackers to infer the correct HMAC...

Algorithm Confusion

signxml is vulnerable to an Algorithm Confusion. The vulnerability is due to Improper enforcement of signature algorithm restrictions are not properly enforced when hmackey is set and requirex509 is disabled, allowing an attacker to bypass verification by using a different signing algorithm inste...

Arbitrary File Upload

xyz.erupt, erupt is vulnerable to arbitrary file upload. The vulnerability is due to improper validation in the /upload/GoodsCategory/image component, allowing attackers to upload crafted files and execute arbitrary code...

Sensitive Information Disclosure

yiisoft/yii2-redis is vulnerable to Sensitive Information Disclosure. The vulnerability is due to information disclosure due to authentication credentials username and password being logged in plain text during failed connection attempts...

Denial Of Service (DoS)

Multer is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of file upload requests with empty string field names, allowing an attacker to crash the server with a crafted request...

Unauthorized Information Disclosure

@haxtheweb/open-apis is vulnerable to unauthenticated information disclosure. The vulnerability is due to improper access control on the haxPsuUsage API endpoint, allowing remote unauthenticated users to retrieve a list of PSU websites hosted on HAX CMS...

Unauthenticated Remote Code Execution (RCE)

github.com/kro-run/kro is vulnerable to Unauthenticated Remote code execution RCE. The vulnerability is due to a confused-deputy scenario, where users with permission to create or modify ResourceGraphDefinition resources can supply arbitrary container images that kro's controllers deploy and run ...

Deserialization Of Untrusted Data

auth0/auth0-php is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to insecure deserialization due to the SDK processing untrusted cookie data without authentication, allowing attackers to inject malicious serialized payloads...

Sensitive Information Disclosure

@auth0/nextjs-auth0 is vulnerable to Sensitive Information Disclosure. The vulnerability is due to missing cache control headers due to session cookies being cached by CDNs, potentially exposing sensitive session information to unauthorized users...

Unauthorized Configuration Manipulation

Jupyter Core is vulnerable to Unauthorized Configuration Manipulation. The vulnerability is due to improper access control on the %PROGRAMDATA% directory, allowing unprivileged users to write configuration files that affect other users on shared Windows systems...

Exposed Dangerous Method Or Function

webpack-dev-server is vulnerable to source code exposure. The vulnerability is due to lack of proper origin checks due to requests for classic scripts not being subject to the same-origin policy, allowing attackers to inject malicious scripts that extract source code if the port and script path a...

Path Traversal

Python tarfile module is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths during extraction with TarFile.extractall or TarFile.extract when using the filter="data" or filter="tar" parameter, which allows an attacker to craft a malicious tar archive that...

Cross-site Scripting (XSS)

github.com/forceu/gokapi is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the API key renaming feature, which allowed authenticated users to inject JavaScript that would execute when another user accessed the API tab...