13,612 results · Clear filters · Feed
-
High 8.3
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
-
High 7.6
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
-
High 7.5
kaml has potential denial of service while parsing input with anchors and aliases
kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAM…
-
High 7.5
Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS
Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2.
-
High 7.5
jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
-
High 7.5
Collection.js vulnerable to Prototype Pollution
Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.
-
High 7.9
Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and n…
-
High 8.8
Go-huge-util vulnerable to path traversal when unzipping files
go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.…
-
High 7.5
silverstripe/graphql Denial of Service vulnerability
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. In versions 4.2.2 and 4.1.1, an attacker could use a specially crafted graphql query to execute a denial of service attack against a website which has a publicly exposed graphql endpo…
-
High 8.2
On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify…
-
High 7.5
Arbitrary local file read vulnerability during template rendering
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.
-
High 8.8
Improper Input Validation In Eclipse BIRT
In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report…
-
High 7.5
Panic when parsing invalid messages in google.golang.org/protobuf
Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
-
High 7.4
Nomad Job Submitter Privilege Escalation Using Workload Identity
HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1.
-
High 8.1
Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth
NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the v…
-
High 7.5
CodeIgniter Shield Password Shucking Vulnerability
CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than exp…
-
High 8.8
github-slug-action vulnerable to arbitrary code execution
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulner…
-
High 8.1
sqlite vulnerable to code execution due to Object coercion
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerabili…
-
High 7.2
Company admin role gives excessive privileges in eZ Platform Ibexa
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
-
High 7.5CVE-2023-28465 Public exploit
HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by t…
-
High 7.0
Incorrect Authorization in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jen…
-
High 7.5
Denial of service in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in hudson.util.MultipartFormDataParser, allowing attackers to …
-
High 7.5
Denial of service in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trig…
-
High 7.5
Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender
** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on wh…
-
High 7.2
Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
-
High 7.8
WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.
-
High —
Constellation allows Emergency shell access during initramfs boot phase
### Impact An active attacker could let the boot fail on purpose in the initramfs, dropping the serial console into an emergency shell. This gives attackers with access to the serial console full control over the VM. ### Patches The issue has been patched in …
-
High 7.3
node-bluetooth is vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation
All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.
-
High 7.3
node-bluetooth-serial-port is vulnerable to Buffer Overflow via the findSerialPortChannel
All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.
-
High 7.5
Rack has possible DoS Vulnerability in Multipart MIME parsing
A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.
-
High 7.7
Data leak through a XAR import XXE attack in xwiki-platform-xar-model
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content…
-
High 8.2
XML External Entity (XXE) Injection in OWSLib
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and…
-
High 8.8
Goutil vulnerable to path traversal when unzipping files
Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip.…
-
High 8.0
HTML Injection in Password Reset email to custom Reset URL in directus
Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. An attacker could exploit this to …
-
High 7.5
Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
-
High 8.8
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
High 8.0
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
High 7.6
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
High 8.0
Cross-site Scripting (XSS) - Stored in answerdev/answer
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
-
High 7.5
Insufficient Session Expiration in pretix
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.