13,612 results · Clear filters · Feed
-
High 7.5
Uncontrolled Resource Consumption in FasterXML jackson-databind
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for des…
-
High 7.5
Uncontrolled Resource Consumption in Jackson-databind
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
-
High 7.5
Multiple DoS Attack Vectors in sflow packet handling
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
-
High 7.5
No limit in length of "Token name" parameter results in DOS attack /memory corruption in ikus060/rdiffweb prior to 2.5.0a3 in ikus060/rdiffweb
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
-
High 7.1
Moodle Stored Cross-site Scripting and page denial of service
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
-
High 7.8
Joplin Remote Code Execution
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existi…
-
High 8.6
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they acce…
-
High 8.6
When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwarder
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. Whe…
-
High 8.6
Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross…
-
High 8.1
Lithium vulnerable to Cross Site Scripting in provided Swagger-UI
### Impact A XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagg…
-
High 8.6
matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Addi…
-
High 7.5
matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms…
-
High 8.4
NuProcess vulnerable to command-line injection through insertion of NUL character(s)
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perfo…
-
High 8.6
Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as…
-
High 7.5
Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shie…
-
High 8.2
Cross-site Scripting (XSS) - Stored in inventree/inventree
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.
-
High —
d3-color vulnerable to ReDoS
The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.
-
High 7.5
Hertz contains path traversal via normalizePath function
Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.
-
High 7.5
Twig may load a template outside a configured directory when using the filesystem loader
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` st…
-
High 8.8
Strapi mishandles hidden attributes within admin API responses
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
-
High 8.5
Bifrost users using basic authntication can bypass write permission limit
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only h…
-
High 7.3
Prototype Pollution
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
-
High 7.3
Arbitrary Code Execution
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
-
High 8.8
Centreon SQL Injection vulnerability via esc_name parameter
Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations.
-
High 7.5CVE-2022-41343 Public exploit
Dompdf allows remote file inclusion because URI validation failure does not halt font registration
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
-
High 8.1
hoek subject to prototype pollution via the clone function.
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
-
High 7.5
secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
-
High 7.1
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
-
High 7.7
Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM library
Not invoking a call to `pam_acct_mgmt` after a call to `pam_authenticate` to check the validity of a login can lead to an authorization bypass. ### Impact #### Exploitability The attack can be carried over the network. A complex non-standard configuration or …
-
High 7.5
Out of Memory issue in ProtocolBuffers for cpp and python
A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 fo…
-
High 7.2
Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled
-
High —
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete
### Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. ### Patches lakeFS v0.82.0 and later ### Workarounds Drop specific request to the lakeFS listen port. Any request wi…
-
High 7.5
Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module
Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.
-
High 7.5
Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP
An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versi…
-
High 7.5CVE-2022-40146 Public exploit
Jar url should be blocked by DefaultScriptSecurity
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.
-
High 7.5
ICEcoder vulnerable to Path Traversal
ICEcoder v8.1 allows attackers to execute a directory traversal.
-
High 7.0
Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffweb
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7.
-
High 7.5
Format String Vulnerability
In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
-
High 8.1
Missing hostname validation in Jenkins View26 Test-Reporting Plugin
Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.
-
High 8.8
Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization
A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.