Authentication Bypass

org.apache.tomcat, tomcat-catalina is vulnerable to Authentication Bypass. The vulnerability exists due to improper exception handling in custom Jakarta Authentication ServerAuthContext components, allowing attackers to bypass authentication and gain unauthorized access...

Denial Of Service (DoS)

org.springframework, spring-webmvc is vulnerable to Denial of Service DoS. The vulnerability is caused by inefficient handling of large request bodies in controller methods with an @RequestBody byte parameter, which allows an attacker to lead to resource exhaustion...

Denial Of Service (DoS)

github.com/cometbft/cometbft is vulnerable to Denial Of Service DoS. The vulnerability is due to improper validation of the ValidatorIndex field in Vote messages, where the usual verification is bypassed for Precommit Vote messages with a non-nil BlockID, allowing invalid messages to go unvalidat...

Cache Poisoning

libcurl.so is vulnerable to Cache Poisoning. The vulnerability is due to improper handling of HSTS cache entries in curl, where a subdomain’s HSTS expiry time can overwrite the parent domain's cache entry, causing incorrect HTTPS timeout handling. It allows an attacker to trigger insecure HTTP...

Case Insensitive Input Validation

org.springframework, spring-context is vulnerable to Case Insensitive Input Validation. The vulnerability is due to improper handling of case insensitivity in String.toLowerCase, where the fix for making disallowedFields patterns case insensitive inadvertently introduced a risk. This behavior...

Out-of-bounds Access

libarchive.so is vulnerable to Out-of-bounds Access. The vulnerability is due to insufficient bounds checking in the executefilteraudio function within archivereadsupportformatrar.c, which allows the src pointer to move beyond the dst pointer when processing crafted archive files...

Buffer Underrun

libmbedtls.so is vulnerable to Buffer Underrun. The vulnerability is due to improper memory handling in pkwrite when writing an opaque key pair, allows an attacker to potentially execute arbitrary code or cause a denial of service...

Improper Authorization

symfony/security-bundle is vulnerable to Improper Authorization. The vulnerability is due to the Security::login method not calling the configured userchecker, preventing proper user validation and allowing unauthorized logins...

Local File Inclusion (LFI)

symfony/runtime is vulnerable to Local File Inclusion LFI. The vulnerability is due to improper handling of the argv values in non-SAPI PHP runtimes, where the registerargvargc directive is set to on, allowing attackers to craft query strings that modify the environment or debug settings used by...

Access Token Leakage

Duende.AccessTokenManagement.OpenIdConnect is vulnerable to access token leakage. The vulnerability is due to improper token isolation within the HTTP client pool, where a refreshed access token is not properly isolated and may be captured by pooled HttpClient instances, allowing an attacker to...

Improper URI Parsing

symfony/http-foundation is vulnerable to Improper URI Parsing. The vulnerability is due to improper parsing of URIs with special characters by the Request class, which does not align with browser behavior, allowing attackers to exploit validators and redirect users to malicious domains...

Denial Of Service (DoS)

com.thoughtworks.xstream, xstream is vulnerable to a Denial of service DoS. The vulnerability is due to a stack overflow that allows an attacker to manipulate the processed input stream when XStream is configured to use the BinaryStreamDriver...

Incorrect Authorization

github.com/hashicorp/nomad is vulnerable to Incorrect Authorization . The vulnerability is due to insufficient validation of CSI volume writes, which allows unauthorized access to create volumes across namespaces...

Improper File URI Scheme Validation

changedetection.io is vulnerable to improper file URI scheme validation. The vulnerability is due to a logic flaw in the issafeurl function, which improperly allows the file: scheme and insufficiently restricts access to local file paths when ALLOWFILEURI is set to false or undefined...

Input Validation Bypass

symfony is vulnerable to input Validation Bypass. The vulnerability is caused by improper handling of the $ metacharacter in regular expressions, allowing an attacker to bypass validation with inputs ending in \n...

Command Hijacking

symfony is vulnerable to Command Hijacking. The vulnerability is due to insecure handling of executable files in the current working directory by the Process class, allowing an attacker to execute arbitrary code by placing a malicious cmd.exe file in the directory...

Cross-site Scripting (XSS)

django-cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be injected and executed...

Out-of-bounds Read And Write

libheif.so is vulnerable to Out-of-bounds Read and Write. The vulnerability is due to insufficient validation of image overlay offsets in the ImageOverlay::parse function, allows the decoding process to access memory outside the allocated bounds, leading to out-of-bounds read and write operations...

Cross-site Scripting (XSS)

firebase is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper handling of the "FIREBASEDEFAULTS" cookie, which allows attackers to manipulate the "authTokenSyncURL" field and redirect user session data to a malicious server...

HTTP Request Smuggling

io.undertow:undertow-core is vulnerable to HTTP Request Smuggling. The vulnerability is due to incorrect parsing of cookies with specific value-delimiting characters, enabling attackers to exfiltrate HttpOnly cookies or spoof additional cookie values...

Race Condition

OpenStack is vulnerable to Race Condition. The vulnerability is due to inadequate validation when deleting non-existent access rules, leading to the removal of unrelated existing access rules that lack application credential associations...

Remote Code Execution (RCE)

LibVNCserver.so is vulnerable to Remote Code Execution RCE. The vulnerability is due to a heap out-of-bounds write in libvncserver/rfbserver.c, allowing a remote attacker to execute arbitrary code on the system...

Timing Attack

mudler/LocalAI is vulnerable to Timing Attack. The vulnerability is due to a side-channel attack that exploits variations in response time during cryptographic operations, potentially exposing valid login credentials...

Man-in-the-middle(MitM) Attack

libnbd is vulnerable to a Man-in-the-middleMitM Attack. The vulnerability is due to the client failing to consistently verify the NBD server's certificate when using TLS to connect, which allows an attacker to intercept and manipulate the NBD traffic...

Insecure File Upload

agnai is vulnerable to an Insecure File Upload. The vulnerability is due to insufficient validation of user-uploaded files, allows attackers to choose the location where the files are stored on the server. potentially leading to overwriting existing files or uploading files to unintended...

Arbitrary File Upload

agnai is vulnerable to Arbitrary File Upload. The vulnerability is due to insufficient validation of uploaded files, allowing attackers to place files in attacker-controlled locations on the server, including executable JavaScript files...

Denial Of Service (DoS)

Werkzeug is vulnerable to Denial Of Service DoS. The vulnerability is due to improper handling of specifically crafted multipart/form-data requests by werkzeug.formparser.MultiPartParser, allowing resource exhaustion and excessive memory allocation...

Privilege Escalation

Rancher Manager is vulnerable to Privilege Escalation. The vulnerability is due to weak Access Control Lists ACL in Rancher Manager deployments containing Windows nodes, allow overly permissive access to sensitive files by BUILTIN\Users or NT AUTHORITY\Authenticated Users...

Improper Input Validation

mudler/LocalAI is vulnerable to Improper Input Validation. The vulnerability is due to improper handling of automatic archive extraction, allowing a 'tarslip' attack to bypass file location restrictions and write files to arbitrary locations on the server...

Cross-site Scripting (XSS)

Lollms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to incomplete filtering in the sanitizesvg function, which fails to account for all potential XSS vectors in uploaded SVG files...

Arbitrary File Read

Gradio is vulnerable to Arbitrary File Read. The vulnerability is due to improper handling of File or UploadButton components, allowing attackers to read arbitrary files from the application server...

Deserialization Of Untrusted Data

Chainer is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper handling of deserialization, allowing the execution of arbitrary code...

Server-Side Request Forgery (SSRF)

Gradio is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the lack of restrictions on URLs in the saveurltocache function, allowing access to local resources and sensitive information...

XML External Entity (XXE)

hapi fhir is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML input. Specifically, the system fails to properly disable or validate external entities within XML documents, allowing attackers to inject malicious XML that can lead to unauthorized data acce...

Information Leakage

symfony/http-client is vulnerable to IP/port enumeration. The vulnerability is due to improper handling of IP filtering in the NoPrivateNetworkHttpClient, which fails to block certain IPs early enough during host resolution, allowing an attacker to enumerate IP addresses and ports, potentially...

XML External Entity (XXE) Injection

org.openimaj, openimaj is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of external entities in XML files. Specifically, the system fails to properly validate or sanitize XML input, allowing attackers to craft malicious XML that can trigger...

Cross-Site Scripting (XSS)

studio-42/elfinder is vulnerable to persistent Cross-site Scripting XSS. The vulnerability is due to a filename restriction bypass, allowing attackers to inject malicious scripts...

Remote Code Execution (RCE)

studio-42/elfinder is vulnerable to Remote Code Execution RCE. The vulnerability is due to the lack of restrictions on uploading files with the .php8 extension, allows an attacker to upload a malicious .php8 file, which can then be executed on the server to gain unauthorized access or execute...

Privilege Escalation

github.com/rclone/rclone is vulnerable to Privilege Escalation. The vulnerability is due to insecure handling of symlinks with the --links and --metadata flags, allows unprivileged users to exploit symlinks to modify the ownership and permissions of target files when copied by a privileged proces...

Unauthorized File Manipulation

ansiblecore is vulnerable to Unauthorized File Manipulation. The vulnerability is due to the user module allowing an unprivileged user with directory traversal permissions to create or replace files on any system path and gain ownership when a privileged user executes the module against the...

Cross-Site Scripting (XSS)

Happy-dom is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation and execution of script tags, which allows arbitrary code to run in the user context of happy-dom...

Authentication Bypass

codechecker is vulnerable to Authentication Bypass. The vulnerability is due to improper URL handling in the API, where the endpoint ending with "/Authentication" fails to properly enforce access controls, allowing unauthorized superuser access to other API endpoints...

Remote Code Execution (RCE)

Langflow is vulnerable to Remote Code Execution RCE. The vulnerability is due to the lack of sandboxing, allowing an attacker to execute arbitrary code on the local machine...

Refresh Token Exposure

@workos-inc/authkit-nextjs is vulnerable to Refresh Token Exposure. The vulnerability is due to improper handling of sensitive data, where refresh tokens are logged to the console if the debug flag, which is disabled by default, is enabled. This allows an attacker with access to the logs to steal...

Code Injection

AgentScope is vulnerable to Code Injection. The vulnerability is due to the eval function in the iscallableexpression function, which executes user-provided commands, allowing potential code injection...

Information Exposure

@workos-inc/authkit-remix is vulnerable to Information Exposure. The vulnerability is due to the debug flag being enabled, which allows an attacker to view refresh tokens logged to the console...

Directory Traversal

github.com/ollama/ollama is vulnerable to Directory Traversal. The vulnerability is due to path traversal in the api/push route, allowing attackers to confirm which files exist on the server...

Sensitive Information Disclosure

github.com/ollama/ollama is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the CreateModel route reflecting "File does not exist" error messages when given a non-existent file path, allowing attackers to confirm file presence on the server...

Denial Of Service (DoS)

github.com/ollama/ollama is vulnerable to Denial-of-Service DoS. The vulnerability is due to the CreateModelHandler function improperly handling the req.Path parameter, which can be set to /dev/random to cause infinite blocking and resource exhaustion...

Improper Authentication

com.baidu.disconf:disconf-core is vulnerable to Improper Authentication. The vulnerability is due to a flaw in the Configuration Center component’s /api/config/list endpoint, which allows remote attackers to bypass authentication...