XML Entity Expansion (XEE)

org.apache.solr, solr-core is vulnerable to an XML Entity Expansion XEE. The vulnerability is due to XML resource consumption caused by the use of XML DOCTYPE and ENTITY declarations, which allows an attacker to trigger excessive memory usage during XML parsing, leading to out-of-memory errors...

Incorrect Authorization

github.com/mattermost/mattermost-server is vulnerable to Incorrect Authorization. The vulnerability is due to insufficient access control mechanisms within the integration between the AI and Wrangler plugins in Mattermost. Specifically, Mattermost fails to properly validate or restrict the use of...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of MFA checks due to a failure to verify that the requesting user matches the target user ID when modifying MFA settings, allowing privilege escalation...

Unauthorized Access

github.com/mattermost/mattermost-server is vulnerable to Unauthorized Access. The vulnerability is due to improper access control due to a failure to enforce the "Allow Users to View Archived Channels" setting when fetching metadata from archived channels, which allows an attacker to access...

Denial Of Service (DoS)

http-proxy-middleware is vulnerable to Denial Of Service DoS. The vulnerability is due to improper conditional logic due to the absence of "else if", which allows an attacker to trigger writeBody twice and potentially disrupt normal application behavior...

XML External Entity (XXE) Injection

RichText is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper input validation due to unsafe XML elements being processed in user-editable RichText fields, allowing attackers with edit permissions to read server files...

Improper Request Handling

http-proxy-middleware is vulnerable to Improper Request Handling. The vulnerability is due to improper request handling caused by fixRequestBody executing even when bodyParser has failed, which allows attackers to smuggle malicious HTTP requests...

Prompt Injection

github.com/mattermost/mattermost-server is vulnerable to prompt injection. The vulnerability is due to insufficient domain restriction to the AI plugin's Jira tool, allowing authenticated users to exfiltrate data from arbitrary servers via crafted prompts...

Information Disclosure

@backstage/plugin-permission-backend is vulnerable to information disclosure. The vulnerability is due to improper handling of conditional decisions in the permission backend, allowing callers to infer sensitive information...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to improper enforcement of the 'Allow users to view/update archived channels' system setting, which allows authenticated users to access member information in archived channels even when the...

Cross-site Scripting (XSS)

golang.org/x/net is vulnerable to improper parsing logic. The vulnerability is due to incorrect tag interpretation in unquoted attribute values ending with a solidus / being mistakenly marked as self-closing, especially in foreign content like or . which allows attackers to exploit content in the...

Deserialization Of Untrusted Data

Whoogle Search is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to improper input sanitization due to the handling of crafted search queries in the /models/config.py component...

Denial Of Service (DoS)

PyTorch is vulnerable to Denial of Service DoS. The vulnerability is due to improper input handling in the torch.nn.functional.ctcloss function, which can be exploited locally to trigger a crash...

Authentication Bypass

Dpanel is vulnerable to Authentication Bypass. The vulnerability is due to use of a hardcoded JWT secret due to the default configuration embedding a static secret, allowing attackers to forge valid tokens and gain unauthorized administrative access...

Sensitive Information Disclosure

Weblate is vulnerable to Sensitive Information Disclosure. The vulnerability is due to exposed sensitive data due to source repository URLs containing credentials being included in client-side URL parameters and logs in plaintext...

Incorrect Execution-Assigned Permissions

aws-cdk-lib is vulnerable to Incorrect Execution-Assigned Permissions. The vulnerability is due to unexpected Aspect execution order due to the introduction of a new priority system that overrides hierarchical aspect evaluation, potentially leading to incorrect permissions boundaries being assign...

Cross-site Scripting (XSS)

jquery-validation is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized user input in the showLabel function due to improper handling of placeholder values that populate messages via $.validator.messages...

Server-Side Request Forgery (SSRF)

Kyverno is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of Service Call destinations due to the ability of attackers to craft policies that initiate requests to arbitrary servers under their control...

Improper Authorization

github.com/nats-io/nats-server is vulnerable to Improper Authorization. The vulnerability is due to missing access restrictions due to certain JetStream management API requests lacking proper access controls, allowing unauthorized administrative actions across accounts...

Denial Of Service (DoS)

vllm is vulnerable to Denial of Service DoS. The vulnerability is due to unbounded in-memory cache growth due to allowing unique schema requests to continually populate the grammar cache, potentially exhausting system RAM...

Privilege Escalation

github.com/argoproj/argo-events is vulnerable to Privilege Escalation. The vulnerability is due to insufficient permission controls due to allowing users with EventSource and Sensor custom resource permissions to escalate privileges and gain access to the host system and cluster...

Incorrect Authorization

Mattermost is vulnerable to Incorrect Authorization. The vulnerability is due to inadequate permission validation that allowing users with delegated granular admin roles to modify system administrators without proper restrictions...

Stack Based Buffer Overflow

org.jsonschema2pojo, jsonschema2pojo-core is vulnerable to Stack-based buffer overflow. The vulnerability is due to improper input validation in the apply function of the SchemaRule.java file, allows attackers to exploit the function, leading to a stack-based buffer overflow...

Authentication Bypass

github.com/mattermost/mattermost-server is vulnerable to a Authentication Bypass. The vulnerability is due to inadequate cache management during the user-to-bot conversion process, which allows an attacker to log in to the bot once using the original user credentials by bypassing normal...

Unauthorized Metadata Access

Mattermost is vulnerable to unauthorized metadata access. The vulnerability is due to improper validation and a failure to check if a file has been deleted when creating a bookmark, allowing an attacker to create bookmarks for deleted files and access their metadata...

OS Command Injection

tcg/voyager is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation of input passed to a specific PHP Artisan command, allowing authenticated administrators to execute arbitrary OS commands in Laravel 8 or later...

Denial Of Service (DoS)

golang.org/x/crypto are vulnerable to a Denial Of Service DoS. The vulnerability is due to incomplete or slow key exchanges, which cause pending content to be read into memory but never transmitted, allowing an attacker to consume server resources and cause a denial of service...

Cross-Site Request Forgery (CSRF)

github.com/gorilla/csrf is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to improper origin validation caused by relying on the r.URL.Scheme field to detect TLS, which is not set for server requests, allowing an attacker with XSS on a related domain to perform...

Unauthorized Access

@directus/api is vulnerable to Unauthorized Data Access. The vulnerability is due to insecure logging practices. Specifically, the access token in the query string is not redacted when the LOGSTYLE is set to raw, allowing sensitive information to be exposed in system logs...

Cross-Site Scripting (XSS)

@sveltejs/kit is vulnerable to cross-site scripting XSS. The vulnerability is due to improper sanitization of search parameter names when iterating over event.url.searchParams in server load functions, allowing attackers to inject malicious scripts via crafted URLs...

XML External Entity (XXE) Injection

ibexa/fieldtype-richtext is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper XML input sanitization due to unsafe elements being allowed in RichText XML, potentially enabling attackers to read server files...

Insertion Of Sensitive Information Into Log File

Apache Pulsar is vulnerable to Insertion of Sensitive Information into Log File. The vulnerability is due to sensitive data exposure due to logging of plaintext Kafka credentials in application logs by various Kafka connectors...

Sandbox Escape

CefSharp is vulnerable to Sandbox Escape. The vulnerability is due to improper handling of system resource handles in Mojo under certain unspecified conditions, allows a malicious file to exploit the flaw and escape the sandbox...

Denial Of Service (DoS)

helm.sh/helm/v3 is vulnerable to Denial Of Service DoS. The vulnerability is due to memory exhaustion due to specially crafted chart archives that decompress to a size significantly larger than their compressed form...

HTTP Request Smuggling

github.com/clickhouse/ch-go is vulnerable to HTTP Request Smuggling. The vulnerability is due to improper parsing or handling of HTTP requests. Specifically, the vulnerability arises from the way large, uncompressed malicious external data is processed, allowing an attacker to smuggle an addition...

Cross-Site Scripting

yiisoft/yii is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to in specific scenarios where the fallback error renderer is used, allowing an attacker to execute arbitrary scripts in the context of the user’s browser...

Arbitrary File Disclosure

Vite is vulnerable to Arbitrary File Disclosure. The vulnerability is due to incorrect assumptions about the presence of in req.url, which is permitted by some runtimes Node, Bun despite being invalid per HTTP specs, allowing attackers to bypass file system access restrictions using path traversa...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to insufficient enforcement of access restrictions on the /api/v4/audits endpoint, allowing users with delegated granular administration roles to access User Activity Logs without Compliance...

HTML Injection

verbb/formie is vulnerable to HTML injection. The vulnerability is due to insufficient sanitization of HTML content in the email notification preview feature, allows an attacker to inject malicious HTML content into the email notification preview...

Unauthorized Network Access

jupyter-remote-desktop-proxy is vulnerable to unauthorized network access. The vulnerability is due to jupyter-remote-desktop-proxy not properly restricting VNC server access to UNIX sockets when using TigerVNC, allowing the server to be accessible over the network...

Cross-Site Scripting (XSS)

verbb/formie is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper output escaping when previewing imported form data, which allows an attacker to inject malicious scripts via tampered field labels or handles in the JSON export...

Stack Overflow

Helm is vulnerable to Stack Overflow. The vulnerability is due to uncontrolled recursion due to deeply nested $ref chains in JSON Schema files within charts, which can exceed the stack size limit during parsing...

Improper Input Validation

org.apache.poi:poi-ooxml is vulnerable to Improper Input validation. The vulnerability is due to improper input validation due to the lack of checks for duplicate ZIP entry names in OOXML files, which can lead to inconsistent parsing behavior across different products...

Cross-site Scripting (XSS)

Silverstripe Framework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient server-side sanitization due to reliance on client-side filtering of specially crafted encoded payloads submitted by content editors...

Cross-site Scripting (XSS)

dnadesign/silverstripe-elemental is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input handling due to failure to cast user input before rendering it in the "Content blocks in use" report grid field...

SQL Injection

joomla/database is vulnerable to SQL injection. The vulnerability is due to improper handling of identifiers due to the quoteNameStr method not safely escaping input, which can allow injection if used in extended classes...

Unsolicited Email Subscription (Spam Abuse)

Shopware is vulnerable to Unsolicited Email Subscription Spam Abuse. The vulnerability is due to insecure default double-opt-in settings due to the lack of confirmation requirements for newsletter sign-ups, allowing attackers to register arbitrary emails and trigger unsolicited emails without use...

Remote Code Execution (RCE)

BentoML is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of specific headers and parameters in POST requests, which allows remote code execution RCE on the server...

SQL Injection

crud-query-parser is vulnerable to SQL Injection. The vulnerability is due to improper neutralization of the order/sort parameter. Specifically, it occurs because there is no property filter setup when using the TypeORM adapter with ordering enabled, allowing an attacker to inject malicious SQL...

Denial Of Service (DoS)

github.com/bep/imagemeta is vulnerable to Denial Of Service DoS. The vulnerability is due to missing upper bounds on memory allocation when parsing metadata in PNG and WebP images, allowing an attacker to craft specially designed images with excessively large metadata...