12,331 results · Clear filters · Feed
-
Low 3.7
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character…
-
Low 2.3
A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credent…
-
Low 2.0
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attr…
-
Low 2.3
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside …
-
Low 2.3
A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to …
-
Low 3.7
JRuby: NONET is bypassed for external DTDs and entities when the systemId uses a short-form IPv4 host
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a …
-
Low 2.0
On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Aut…
-
Low 2.0
Winter CMS: Stored XSS through Backend List widget image columns
Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without esca…
-
Low 2.3
In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially co…
-
Low 3.3
Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the g…
-
Low 3.3
Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by…
-
Low 3.7
Forge: Ed25519 signature verification accepts small-order public keys
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 …
-
Low 2.0
Incorrect calculation of buffer size in the MigTD's servtd_get_quote for the Intel(R) TDX Migration Trust Domain (MigTD…
-
Low 3.3
Data Deduplication Security Feature Bypass Vulnerability
Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally.
-
Low 3.3
Windows Language Experience Service Tampering Vulnerability
Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally.
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had c…
-
Low 2.3
compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation witho…
-
Low 2.3
compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0's output
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place …
-
Low 2.3
compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed wit…
-
Low 2.3
compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0's JSON and SARIF output on stdout
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdo…
-
Low 2.0
Missing authentication for critical function for some AI Playground software before version v3.1.1-beta within Ring 3: …
-
Low 2.3
In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structur…
-
Low 2.3
Uncontrolled XML entity expansion in the Flock Installer app for Android
An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running And…
-
Low 2.3
Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handl…
-
Low 1.2
Missing permission check in ticket layout API
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
-
Low 2.3
Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they …
-
Low 3.5
A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected t…
-
Low 3.9
The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting …
-
Low 3.1
Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI)
Due to a missing authorization check in certain remote-enabled functionality, SAP Solution Tools Plug-In allows an authenticated attacker to invoke this functionality to access data that would otherwise be restricted. Exploitation is only possible under certa…
-
Low 3.1
Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read
Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or…
-
Low 2.3
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch sha…
-
Low 2.3
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to…
-
Low 3.7
The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-…
-
Low 3.7
Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore p…
-
Low 3.7
Wagtail: Identification of documents by SHA1 hash
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unaut…
-
Low 3.7
Dynatrace MCP Server: create_dynatrace_notebook missing the human-approval gate
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write …
-
Low 3.3
nushell Data Conversion ser.rs escape_bytes control sequence
A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequen…
-
Low 3.5
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPad…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeigh…
-
Low 3.3
FFmpeg through 9.0.2 Integer Overflow via dng_decode_tiles() in libavcodec/tiff.c
FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outpu…