13,612 results · Clear filters · Feed
-
High 7.5
Arbitrary Code Injection
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
-
High 7.5
Denial of Service (DoS)
The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.
-
High 8.1
Deserialization of Untrusted Data
The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote serve…
-
High 7.0
Ill-formed headers may lead to unexpected behavior in Istio
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at …
-
High —
Cross Site Scripting vulnerability in django-jsonform's admin form.
### Description django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks. Thi…
-
High 7.5
Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle
Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a …
-
High 8.1
Command Injection
The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags ca…
-
High 8.8
Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis
Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
-
High 8.1CVE-2022-1993 EPSS 37%
Path Traversal in gogs/gogs
Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
-
High 7.5
Improper Check for Unusual or Exceptional Conditions in Elasticsearch
A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.
-
High 7.5
Server-Side Request Forgery in Jodd HTTP
Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted …
-
High 7.5
Node DOS by way of memory exhaustion through ExecSync request in CRI-O
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after co…
-
High 8.2
Multiple evaluation of contract address in call in vyper
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incor…
-
High 7.8
TiDB authentication bypass vulnerability
TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in priv…
-
High 8.1
Deserialization of Untrusted Data
The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploit…
-
High 7.5
Denial of service binding form from JSON in Play Framework
Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2.8.3 through 2.8.15 of Play's forms library, in both the Scala and Java APIs. This can occur when using either the `Form#bindFromRequest` m…
-
High 8.3
Server-Side Request Forgery (SSRF) in gogs/gogs
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.
-
High 8.6
Flower OAuth authentication bypass
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting dow…
-
High —
Command injection in librenms
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters.
-
High 8.8
Cross Site Request Forgery in Mingsoft MCMS
An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
-
High —
OS Command Injection in s3-uploader
OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.
-
High —
OS Command Injection in proctree
OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function.
-
High 8.1
Command injection in google-it
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from g…
-
High —
OS Command injection in ssl-utils
OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest() and the createCert() functions.
-
High 8.8
OS Command Injection in gitsome
OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository.
-
High —
Command injection in docker-tester
OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file.
-
High 8.8
OS Command Injection in lifion-verify-deps
lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.
-
High 7.5
npm packing does not respect root-level ignore files in workspaces
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7…
-
High 7.5
Phoenix-ws source code and data in extensions folder is publicly available
### Impact All of the source code, files, and folders in `phoenix_files/extensions/` are available to end users through a simple HTTP GET request. ### Patches The issue has been patched. The users of version 1.0.6 and above are not effected.
-
High 7.4
Cross-site Scripting in Filter Stream Converter Application in XWiki Platform
XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 1…
-
High 7.5CVE-2022-23082 Public exploit
CureKit - Path Traversal in isFileOutsideDir
In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to path traversal.
-
High 8.2
Prototype Pollution
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or…
-
High 7.5
Denial of Service Vulnerability in Rack Multipart Parsing
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.
-
High —
SQL injection in jflyfox jfinal
Jfinal cms 5.1.0 is vulnerable to SQL Injection.
-
High 7.8
Arbitrary command execution in Minidoc
An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.
-
High 7.5
Buffer over-flow in Pillow
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
-
High 8.6
HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
-
High 7.5
Arbitrary file read in ginadmin
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.
-
High 7.5
Path traversal in ginadmin
In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.
-
High 8.7
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allow the uploading of SVG files ('image/svg+xml'), navigating directly to an SVG file URI could execute…