Cross-site Request Forgery (CSRF)

wallabag is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient request validation, allowing attackers to arbitrarily delete user accounts via the /account/delete endpoint...

Directory Traversal

gogs.io/gogs is vulnerable to Directory Traversal. The vulnerability is due to improper input validation in the editFilePost function of internal/route/repo/editor.go, allowing attackers to access unintended directories...

XML External Entity (XXE) Injection

HAPI FHIR is vulnerable to XML External Entity XXE Injection. The vulnerability is due to insecure XML parsing by HAPI FHIR, specifically within the XSLT parsing components, which improperly handle external entity references in XML files. It allows attackers to inject malicious XML content, such ...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper input sanitization when adding notes to a device, allowing JavaScript code in the notes to be triggered when the ExamplePlugin is enabled...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of the "token" parameter, which allows authenticated users to inject arbitrary JavaScript when creating a new API token...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of the "unit" parameter in the "Custom OID" tab, allowing authenticated users to inject arbitrary JavaScript when creating a new OID...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of user input in the "overwriteip" parameter, allowing untrusted data JavaScript code to be stored and executed in the application without proper validation or escaping...

Improper Authorization

Moodle is vulnerable to Improper Authorization. The vulnerability is due to insufficient access control, allowing users to view the schedule of a report even if they lack permission to edit that report...

Sensitive Data Exposure

apacheairflow is vulnerable to Sensitive Data Exposure. The vulnerability is due to sensitive variable values being logged unencrypted in audit logs when set via the CLI, which allows an attacker with audit log access to view those sensitive values...

Sensitive Information Exposure

Moodle is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper error handling, allowing users with the "send message" capability to view the names of other users they should not have access to via an error message in the Messaging system...

Sensitive Information Exposure

filament/actions is vulnerable to Sensitive Information Exposure. The vulnerability is due to insecure default configuration, specifically setting the public disk as the default storage disk, which allows sensitive files, such as exports, to be stored in a location that is publicly accessible,...

Insufficient Access Control

Moodle is vulnerable to Insufficient Access Control. The vulnerability is due to inadequate permission enforcement, allowing users to delete audiences from reports they are not authorized to modify...

XML External Entity (XXE)

phpoffice/phpexcel is vulnerable to an XXE XML External Entity. The vulnerability is due to improper parsing of XML data, which allows attackers to inject external entities and potentially access sensitive files or execute malicious code...

Improper Authorization

Moodle is vulnerable to Improper Authorization. The vulnerability is due to inadequate permission checks, allowing users to edit or delete RSS feeds they are not authorized to modify...

Authentication Bypass

Apache ZooKeeper is vulnerable to Authentication Bypass. The vulnerability is due to weak client IP address validation in IPAuthenticationProvider, where the Admin Server trusts the X-Forwarded-For HTTP header by default, allowing attackers to spoof their IP address and bypass IP-based...

Denial Of Service (DoS)

litestar is vulnerable to Denial of Service DoS. The vulnerability is due to the multipart form parser, which expects the entire request body as a single byte string without a default size limit, allowing attackers to cause excessive memory consumption by uploading arbitrarily large files...

Directory Traversal

statamic/cms is vulnerable to Directory Traversal. The vulnerability is due to improperly handled filenames in asset uploads, which could allow files to be placed in unintended locations on the server, potentially overriding existing files...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input validation and sanitization of the "name" parameter, allowing malicious JavaScript to be stored and executed in other users' sessions...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation of the "hostname" parameter on the "Capture Debug Information" page, allowing authenticated users to inject arbitrary JavaScript...

Reflected Cross-site Scripting (XSS)

librenms/librenms is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to insufficient sanitization in the "reportthis" function, allowing attackers to inject and execute arbitrary JavaScript code via the "section" parameter of the "logs" tab...

Cross-site Scripting (XSS)

redaxo/source is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of data in the mediapool feature, allowing a remote attacker to escalate privileges...

SQL Injection

github.com/devtron-labs/devtron is vulnerable to SQL Injection. The vulnerability is due to insufficient sanitization of user inputs in the CreateUser API /orchestrator/user, allowing authenticated users with minimal permissions to execute malicious SQL queries...

Cross-site Scripting (XSS)

lxmlhtmlclean is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of context-switching for special HTML tags such as , , and by the HTML parser in versions prior to 0.4.0, allowing malicious scripts to bypass the cleaning process...

Out-of-bounds Read

libsndfile.so is vulnerable to Out-of-bounds Read. The vulnerability is due to improper handling of the vorbisanalysiswrote function in the oggvorbis.c file, which fails to validate input data, allowing an attacker to craft a malicious Vorbis file that triggers the out-of-bounds read when process...

Improper Privilege Management

Apache Kafka Clients is vulnerable to Improper Privilege Management. The vulnerability is due to ConfigProvider plugins, including FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider, allowing untrusted users to read arbitrary files or environment variables, potentially leading ...

Reachable Assertion

libsndfile.so is vulnerable to Reachable Assertion. The vulnerability is due to improper handling of certain inputs or conditions in the mpegl3encoderclose function, which allows an attacker to craft specific inputs that trigger the assertion failure, potentially causing the application to crash...

Path Traversal

net.sf.mpxj, mpxj is vulnerable to Path Traversal. The vulnerability is due to an incomplete patch for CVE-2020-35460, which still allows the construction of malicious paths to write files to arbitrary locations...

Remote Code Execution (RCE)

7-Zip is vulnerable to remote code execution RCE. The vulnerability is due to improper validation of user-supplied data in the Zstandard decompression implementation, causing an integer underflow that allows attackers to execute arbitrary code in the context of the current process...

Cross-Site Scripting

Deluge Web-UI is vulnerable to a Cross-Site Scripting. The vulnerability is due to improper sanitization of data from torrent files, where crafted torrent metadata is rendered directly as HTML, allowing attackers to execute arbitrary JavaScript in the user’s browser when a malicious torrent file ...

HTML Injection

org.hibernate.validator, hibernate-validator is vulnerable to HTML Injection. The vulnerability is due to improper validation in the 'isValid' method of the SafeHtmlValidator class, where the tag ending can be omitted by using a less-than character, allowing invalid HTML to be rendered...

Cross-Site Scripting (XSS)

unopim/unopim is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input validation in the Create User function, allowing attackers to exploit an SVG document to steal cookies...

Unauthorized Method Execution

twig/twig is vulnerable to unauthorized method execution. The vulnerability is due to improper enforcement of security policies in Twig's sandbox environment, which allows the toString method to be called on objects when they are part of arrays or argument lists, even if the method is disallowed ...

Improper Attribute Access

twig/twig is vulnerable to improper attribute access. The vulnerability is due to insufficient security checks via the property policy and the isset method on Array-like objects, allowing attackers to bypass the sandbox's security policy and access restricted attributes...

Improper Authentication

Cobbler is vulnerable to Improper Authentication. The vulnerability is due to the utils.getsharedsecret function always returning -1, allowing unauthorized users with network access to authenticate as a user with full control of the server...

Sensitive Information Exposure

org.graylog:graylog-parent is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper handling of concurrent report rendering requests, where a shared headless browser instance may return the report of one user to another, potentially exposing sensitive data...

Memory Leakage

aiohttp is vulnerable to Memory Leakage. The vulnerability is due to improper handling of MatchInfoError, where each error creates a unique cache entry, allowing an attacker to exhaust server memory with numerous requests...

HTTP Request Smuggling

aiohttp is vulnerable to HTTP Request Smuggling. The vulnerability is due to incorrect parsing of newlines in chunk extensions via the feeddata function by which an attacker can bypass firewall or proxy protections by sending specially crafted requests...

Cross Site Scripting

org.apache.tomcat, tomcat-jasper is vulnerable to Cross Site Scripting. The vulnerability is due to improper management of the object lifecycle, where objects are not properly reset or disposed of after use...

Incorrect Object Recycling And Re-use

Apache Tomcat is vulnerable to Incorrect object recycling and re-use. The vulnerability is due to flawed object recycling logic in Apache Tomcat's HTTP/2 implementation. Specifically, the request and response objects are not properly cleared or segregated before being reused, allowing data from o...

Authentication Bypass

org.apache.tomcat, tomcat-catalina is vulnerable to Authentication Bypass. The vulnerability exists due to improper exception handling in custom Jakarta Authentication ServerAuthContext components, allowing attackers to bypass authentication and gain unauthorized access...

Denial Of Service (DoS)

org.springframework, spring-webmvc is vulnerable to Denial of Service DoS. The vulnerability is caused by inefficient handling of large request bodies in controller methods with an @RequestBody byte parameter, which allows an attacker to lead to resource exhaustion...

Denial Of Service (DoS)

github.com/cometbft/cometbft is vulnerable to Denial Of Service DoS. The vulnerability is due to improper validation of the ValidatorIndex field in Vote messages, where the usual verification is bypassed for Precommit Vote messages with a non-nil BlockID, allowing invalid messages to go unvalidat...

Cache Poisoning

libcurl.so is vulnerable to Cache Poisoning. The vulnerability is due to improper handling of HSTS cache entries in curl, where a subdomain’s HSTS expiry time can overwrite the parent domain's cache entry, causing incorrect HTTPS timeout handling. It allows an attacker to trigger insecure HTTP...

Case Insensitive Input Validation

org.springframework, spring-context is vulnerable to Case Insensitive Input Validation. The vulnerability is due to improper handling of case insensitivity in String.toLowerCase, where the fix for making disallowedFields patterns case insensitive inadvertently introduced a risk. This behavior...

Out-of-bounds Access

libarchive.so is vulnerable to Out-of-bounds Access. The vulnerability is due to insufficient bounds checking in the executefilteraudio function within archivereadsupportformatrar.c, which allows the src pointer to move beyond the dst pointer when processing crafted archive files...

Buffer Underrun

libmbedtls.so is vulnerable to Buffer Underrun. The vulnerability is due to improper memory handling in pkwrite when writing an opaque key pair, allows an attacker to potentially execute arbitrary code or cause a denial of service...

Improper Authorization

symfony/security-bundle is vulnerable to Improper Authorization. The vulnerability is due to the Security::login method not calling the configured userchecker, preventing proper user validation and allowing unauthorized logins...

Local File Inclusion (LFI)

symfony/runtime is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper handling of the argv values in non-SAPI PHP runtimes, where the registerargvargc directive is set to on, allowing attackers to craft query strings that modify the environment or debug settings used by...

Access Token Leakage

Duende.AccessTokenManagement.OpenIdConnect is vulnerable to access token leakage. The vulnerability is due to improper token isolation within the HTTP client pool, where a refreshed access token is not properly isolated and may be captured by pooled HttpClient instances, allowing an attacker to...

Improper URI Parsing

symfony/http-foundation is vulnerable to Improper URI Parsing. The vulnerability is due to improper parsing of URIs with special characters by the Request class, which does not align with browser behavior, allowing attackers to exploit validators and redirect users to malicious domains...