Advisory Catalog

Jupyter Notebook file bypasses sanitization, executes JavaScript

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application.

pym.js CSRF Vulnerability

RubyGems Infinite Loop vulnerability

RubyGems Deserialization of Untrusted Data vulnerability

RubyGems Link Following vulnerability

Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter ..

Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server. that can result in Code execution on the server . This attack appear to be exploitable via Being a CSRF, victim interaction is needed, when the vic

tiny-json-http missing SSL certificate validation

hammer_cli_foreman Improper Certificate Validation vulnerability

Jubatus 1.0.2 and earlier allows remote code execution via unspecified vectors.

Electron protocol handler browser vulnerable to Command Injection

Auth0-js bypasses CSRF checks

SimpleSAMLphp saml2 incorrect signature validation

SimpleSAMLphp Improper Verification of Cryptographic Signature

Regular Expression Denial of Service in moment

AWS Lambda parser is vulnerable to Regular Expression Denial of Service

Drupal access bypass vulnerability

Drupal Comment reply form allows access to restricted content

uWSGI Directory Traversal vulnerability

Incorrect Permission Assignment for Critical Resource in NPM

OpenStack Nova Denial of service attack on the compute host

JupyterHub OAuthenticator elevation of privilege

Remote command execution via "go get" command with "-insecure" option in cmd/go

Apache Thrift Go Library Command Injection

Jerome Gamez Firebase Admin SDK for PHP Incorrect Access Control vulnerability

Borg Improper Access Control vulnerability

Remote command execution via "go get" command with cgo in cmd/go

Adobe Flash Player Use-After-Free Vulnerability

Django vulnerable to information leakage in AuthenticationForm

Pycrypto generates weak key parameters

Echor Ruby Gem credentials can be stolen via process table monitoring

Echor contains Command Injection

SimpleSAMLphp Signature validation bypass

SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability

Denial of Service in miekg-dns

ReDoS in brace-expansion

Omniauth allows POST parameters to be stored in session

Directory traversal vulnerability in Next.js

Remote Code Execution in electron

Yii Framework reflected Cross-site Scripting

Yii Framework Cross-Site Request Forgery (CSRF)

SQL Injection in Zenario 7.1-7.6

keycloak-httpd-client-install Insecure Secrets

OXID eShop user impersonation vulnerability

Denial of Service in jquery

WPGlobus plugin Stored XSS & CSRF security vulnerability

brbackup exposes database password to unauthorized users

lynx doesn't properly sanitize user input and exposes database password to unauthorized users

Kcapifony gem for Ruby places database user passwords on the command line