Server-Side Request Forgery (SSRF)

github.com/imgproxy/imgproxy is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper restriction of loopback addresses, allowing access to local services by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false...

XML External Entity

org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli and org.hl7.fhir.publisher:org.hl7.fhir.publisher.core are vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper XML parsing due to XSLT transforms allowing malicious XML with external entity references to access...

Cross-Origin Resource Sharing (CORS) Misconfiguration

Nuxt is vulnerable to Cross-Origin Resource Sharing CORS misconfiguration. The vulnerability is due to default CORS settings in Nuxt, which allowed any website to send requests to the development server and read the responses. It allows an attacker to send requests from a malicious website and...

Incorrect Usage Of Seeds

org.apache.cocoon, cocoon-forms-impl is vulnerable to Incorrect Usage of Seeds . The vulnerability is due to predictability in the random number generation process, as the PRNG was seeded with the startup time, allowing attackers to guess continuation identifiers and access unauthorized...

Script Injection

Nuxt is vulnerable to Script injection. The vulnerability is due to the lack of same-origin policy enforcement for script requests, allows attackers to inject malicious scripts into a victim's site via a script tag, bypassing security measures intended to prevent such cross-origin interactions...

Incorrect Default Permissions

org.jenkins-ci.plugins, oic-auth is vulnerable to Incorrect Default Permissions. The vulnerability is due to the Jenkins OpenId Connect Authentication Plugin improperly handling username case sensitivity, which allows attackers to bypass authentication mechanisms by submitting usernames that diff...

Authentication Bypass

Keycloak is vulnerable to Authentication Bypass. The vulnerability is due to the system updating passwords without performing an LDAP bind to validate the new credentials against Active Directory, allowing users with expired or disabled AD accounts to regain access and bypass AD restrictions...

Sensitive Data Exposure

github.com/cilium/cilium is vulnerable to Sensitive Data Exposure. The vulnerability is due to improper default configuration of the Access-Control-Allow-Origin header, which allows cross-origin requests from untrusted sources, potentially exposing sensitive information when accessing the Hubble ...

Sensitive Information Exposure

github.com/updatecli/updatecli is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper log sanitization due to private Maven repository credentials being exposed in logs when a retrieval operation fails...

Cross-site Scripting (XSS)

store2 is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the store.deep.js component, allowing a remote attacker to execute arbitrary code...

Denial Of Service (DoS)

github.com/cilium/cilium is vulnerable to Denial Of Service DoS. The vulnerability is due to a flaw in Cilium's handling of DNS traffic when configured to proxy it in a Kubernetes cluster, allowing an attacker to send a crafted DNS response to workloads outside the cluster, causing Cilium agents ...

Cross-site Scripting (XSS)

pscontactinfo is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of formatted addresses, which allows stored script execution when combined with third-party modules...

Cross-Site Scripting (XSS)

phpmyadmin/phpmyadmin is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of user-supplied input in table or database names within the check tables feature, allowing an attacker to execute arbitrary JavaScript in the victim's browser...

Sandbox Escape

restrictedpython is vulnerable to Sandbox Escape. The vulnerability is due to a type confusion bug in CPython when using try/except, which allows an attacker to bypass the security restrictions in RestrictedPython...

Path Traversal

github.com/envoyproxy/gateway is vulnerable to a Path Traversal. The vulnerability is due to improper access control, allowing a user with access to the Kubernetes cluster to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway...

Temporary File Retention

@fastify/multipart is vulnerable to Temporary File Retention. The vulnerability is due to the saveRequestFiles function failing to delete temporary uploaded files when a user cancels the request, allows an attacker to repeatedly initiate and cancel file uploads, leading to excessive disk space...

Remote Code Execution (RCE)

craftcms/cms is vulnerable to Remote Code Execution RCE. The vulnerability is due to compromised security keys, which allow attackers to execute arbitrary code on affected installations...

Privilege Escalation

Directus is vulnerable to Privilege Escalation. The vulnerability is due to improper access control in the sharing feature, which allows users to specify arbitrary roles, bypassing role-based restrictions and gaining access to fields that are normally restricted for certain roles...

Denial Of Service (DoS)

org.apache.wicket,wicket-core is vulnerable to Denial of Service DOS. The vulnerability is due to improper request handling in the core, which allows an attacker to flood the server with multiple requests to server resources, leading to a Denial of Service...

Reflected Cross Site Scripting (XSS)

silverstripe/framework is vulnerable to cross-site scripting XSS. The vulnerability is due to improper handling of error messages, which allows execution of a malicious payload included in a URL when the website is set to the "dev" environment mode...

Arbitrary Code Execution (ACE)

asteval is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to insufficient input validation, which allows attackers to bypass safety restrictions and execute arbitrary Python code within the application's context...

Cross-site Scripting (XSS)

Umbraco is vulnerable to cross-site scripting XSS. The vulnerability is due to improper sanitization in certain localized backoffice components, allowing authenticated users to inject malicious scripts when viewing these components...

Server-Side Request Forgery (SSRF)

Fedify is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the Webfinger mechanism, allowing attackers to perform GET requests to internal resources, cause denial of service via infinite loops, or execute blind SSRF attacks...

Denial Of Service (DoS)

org.apache.cxf, cxf-core is vulnerable to Denial of Service DoS. The vulnerability is due to CachedOutputStream instances not being closed in certain edge cases, potentially filling up the file system when backed by temporary files, allows an attacker to exhaust the file system...

Out Of Memory Error

org.elasticsearch, elasticsearch is vulnerable to Out of Memory Error. The vulnerability is due to unrestricted resource allocation in Elasticsearch, where there are no limits or throttling mechanisms in place to manage resource usage effectively. It allows malicious queries, such as those using...

Credential Disclosure

github.com/writefreely/writefreely is vulnerable to Credential Disclosure. The vulnerability is due to improper configuration management. Specifically, the sensitive information in the config.ini file is not adequately protected, allowing local users to access it and discover credentials when MyS...

Cross-Site Request Forgery (CSRF)

codechecker is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper authentication handling in CodeChecker, which allows an attacker to hijack the authentication of a logged-in user and perform actions with the same permissions...

Cross-site Scripting (XSS)

YesWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation in the attach component, where a non-existing resource in the file attribute generates a file upload button, allowing authenticated users with edit or comment permissions to inject malicious scripts...

Relative Path Traversal

github.com/hashicorp/go-slug is vulnerable to Relative Path Traversal. The vulnerability is due to improper path validation when extracting user-provided paths from tar entries, allowing for directory traversal and potential overwriting of arbitrary files...

Cross-site Scripting (XSS)

YesWiki is vulnerable to a Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of user input in the search by tag feature, allowing a malicious user to craft a link that triggers an XSS when clicked. This results in potential account takeover, stealing other accounts,...

Denial Of Service (DoS)

The compose-go library is vulnerable to a Denial of Service DoS. The vulnerability is due to excessive memory and CPU consumption when parsing malicious YAML payloads, which can be sent by an authorized user...

Predictable Boundary Selection

Undici is vulnerable to predictable boundary selection. The vulnerability is due to the use of Math.random to choose the boundary, which can be predicted if several of its values are known, potentially allowing an attacker to tamper with requests to backend APIs...

Cross-Site Scripting (XSS)

PhpSpreadsheet is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization or escaping of user input when converting XLSX files into HTML, allows malicious scripts to be embedded in the file content and executed in the context of the user's browser...

Arbitrary File Deletion

yeswiki/yeswiki is vulnerable to Arbitrary File Deletion. The vulnerability is due to improper file permission handling, where authenticated users can delete files owned by the FastCGI Process Manager FPM user, allowing them to arbitrarily remove critical files without any scope limitation...

Account Enumeration

umbraco.cms is vulnerable to Account Enumeration. The vulnerability is due to discrepancies in response codes and the timing of Umbraco management API responses, which allow attackers to infer the existence of specific accounts...

Cross-Site Scripting (XSS)

mathlive is vulnerable to Cross-site scripting XSS. The vulnerability is due to the lack of proper escaping of HTML content when using commands like \htmlData, which allows the injection and execution of malicious scripts...

Privilege Escalation

github.com/containers/buildah is vulnerable to Privilege Escalation. The vulnerability is due to improper use of the --mount flag in multi-stage builds, which exposes content from the build host to the command run in the RUN instruction. When the build process is performed with root privileges, i...

Remote Code Execution (RCE)

system.linq.dynamic.core is vulnerable to Remote code execution RCE. The vulnerability is due to insufficient input validation and improper access control when handling reflection types and static properties/fields in the System.Linq.Dynamic.Core library, allows remote access without proper...

Insecure TLS Configuration

aws-cdk-lib is vulnerable to Insecure TLS configuration. The vulnerability is due to the tls.connect method setting rejectUnauthorized: false by default, which allows connections to unauthorized OIDC providers without verification. This could potentially allow attackers to exploit insecure...

Unbounded Disk Consumption

github.com/t2bot/matrix-media-repo is vulnerable to Unbounded Disk Consumption. The vulnerability is MMR's lack of proper rate limiting and controls on the amount of data that can be requested and cached, allowing unauthenticated users to request excessive amounts of remote media files...

Stored Cross-site Scripting (XSS)

librenms/librenms is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to insufficient input sanitization of the descr parameter in /ajaxform.php, allows malicious scripts to be injected and stored in the system...

Access Control Bypass

zotregistry.dev/zot is vulnerable to Access Control Bypass. The vulnerability is due to group data being stored as an append-list in the boltdb database meta.db, where group memberships are appended instead of replaced. It allows unauthorized access to persist, enabling attackers to retain...

Cross-Site Scripting (XSS)

KateX is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient sanitization of input. When users render untrusted mathematical expressions using renderToString, malicious input containing \htmlData can bypass validation, allowing for the execution of arbitrary JavaScrip...

Reflected Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of the community parameter on the /addhost page, allowing remote attackers to inject malicious scripts, which execute when the page is viewed or interacted with...

Stored Cross-site Scripting (XSS)

librenms/librenms is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of the display parameter in the /device/$DEVICEID/edit endpoint, allowing remote attackers to inject malicious scripts...

Stored Cross-site Scripting (XSS)

librenms/librenms is vulnerable to Stored cross-site scripting XSS. The vulnerability is due to insufficient input sanitization of the display parameter in the /device/$DEVICEID/edit endpoint, allowing attackers to inject and store malicious scripts on the server...

Stored Cross-site Scripting (XSS)

librenms/librenms is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper input sanitization of the state parameter in ajaxform.php, which allows an attacker to inject malicious scripts that execute when a user views or interacts with the affected page...

Broken Object Level Authorization

Indico is vulnerable to a Broken Object Level Authorization BOLA vulnerability. The vulnerability is due to insufficient access control in the /api/principals component, which allows attackers to retrieve information about other user accounts by sending crafted POST requests...

Improper Input Validation

Mattermost is vulnerable to Improper Input Validation. The vulnerability is due to the failure to properly handle attachment fields that cannot be cast to a String, leading to a crash in the web application. Attackers can exploit this by creating and sending specially crafted posts with such...

Arbitrary Code Execution

github.com/t2bot/matrix-media-repo is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to improper validation of file types during the thumbnail generation process, where MMR relies on user-supplied file type values to select decoders e.g., ImageMagick or ffmpeg, which can...