Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.
AFFECTED_PRODUCTS:
Cyrusimap Cyrus Imap,
Cyrusimap Cyrus Imap
Files or Directories Accessible to External Parties vulnerability in smb server in ProjectDiscovery Interactsh allows remote attackers to read/write any files in the directory and subdirectories of where the victim runs interactsh-server via anonymous login.
AFFECTED_PRODUCTS:
Projectdiscovery Interactsh
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of get_items_permissions_check function. This makes it possible for unauthenticated attackers to extract basic info...
AFFECTED_PRODUCTS:
Thimpress Learnpress
The Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'np1' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...
AFFECTED_PRODUCTS:
Thenewsletterplugin Newsletter
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file report/index.php. The manipulation of the argument procduct leads to sql injection. The attack may be launched remotely. The ex...
AFFECTED_PRODUCTS:
Bakery Online Ordering System Project Bakery Online Ordering System
A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intended to restrict access to intranet IP addresses and protocols. Despite efforts to filter out intranet IP addresses starting with 192, 172,...
AFFECTED_PRODUCTS:
Mintplexlabs Anythingllm
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
Rejected reason: CVE ID was once reserved, but never used.
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument txtsearch leads to sql injection. The attack can be launched remotely. The...
AFFECTED_PRODUCTS:
Bakery Online Ordering System Project Bakery Online Ordering System
LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.
AFFECTED_PRODUCTS:
Lylme Lylme Spage
netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which woul...
AFFECTED_PRODUCTS:
Netty Netty Incubator Codec Ohttp
Cross Site Scripting vulnerability in audimex audimexEE v.15.1.2 and fixed in 15.1.3.9 allows a remote attacker to execute arbitrary code via the service, method, widget_type, request_id, payload parameters.
AFFECTED_PRODUCTS:
Web-Audimex Audimexee
Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing
AFFECTED_PRODUCTS:
Canonical Ubuntu Linux,
Canonical Ubuntu Linux,
Canonical Ubuntu Linux
... (+2)
Apport does not disable python crash handler before entering chroot
AFFECTED_PRODUCTS:
Canonical Ubuntu Linux,
Canonical Ubuntu Linux,
Canonical Ubuntu Linux
... (+2)
is_closing_session() allows users to consume RAM in the Apport process
AFFECTED_PRODUCTS:
Canonical Ubuntu Linux,
Canonical Ubuntu Linux,
Canonical Ubuntu Linux
... (+2)
is_closing_session() allows users to create arbitrary tcp dbus connections
AFFECTED_PRODUCTS:
Canonical Ubuntu Linux,
Canonical Ubuntu Linux,
Canonical Ubuntu Linux
... (+2)
is_closing_session() allows users to fill up apport.log
AFFECTED_PRODUCTS:
Canonical Ubuntu Linux,
Canonical Ubuntu Linux,
Canonical Ubuntu Linux
... (+2)
~/.config/apport/settings parsing is vulnerable to "billion laughs" attack
AFFECTED_PRODUCTS:
Canonical Ubuntu Linux,
Canonical Ubuntu Linux,
Canonical Ubuntu Linux
... (+2)
Prior to 23.1, an information disclosure vulnerability exists within BeyondInsight which can allow an attacker to enumerate usernames.
AFFECTED_PRODUCTS:
Beyondtrust Beyondinsight
Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a server-side request forgery vulnerability.
AFFECTED_PRODUCTS:
Beyondtrust Beyondinsight
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
Envoy is a cloud-native, open source edge and service proxy. Due to how Envoy invoked the nlohmann JSON library, the library could throw an uncaught exception from downstream data if incomplete UTF-8 strings were serialized. The uncaught exception would cause Envoy to crash.
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
Envoy is a cloud-native, open source edge and service proxy. There is a use-after-free in `HttpConnectionManager` (HCM) with `EnvoyQuicServerStream` that can crash Envoy. An attacker can exploit this vulnerability by sending a request without `FIN`, then a `RESET_STREAM` frame, and then after receiv...
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
Envoy is a cloud-native, open source edge and service proxy. There is a crash at `QuicheDataReader::PeekVarInt62Length()`. It is caused by integer underflow in the `QuicStreamSequencerBuffer::PeekRegion()` implementation.
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
Envoy is a cloud-native, open source edge and service proxy. A crash was observed in `EnvoyQuicServerStream::OnInitialHeadersComplete()` with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after `StopReading()` being called on the stream. As after `Stop...
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching proto...
AFFECTED_PRODUCTS:
Envoyproxy Envoy,
Envoyproxy Envoy,
Envoyproxy Envoy
... (+1)
An improper access control vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically in version 20240410. This vulnerability allows any user on the server to access the chat history of any other user without requiring any form of interaction between the users. Exploitation of...
AFFECTED_PRODUCTS:
Gaizhenbiao Chuanhuchatgpt
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
AFFECTED_PRODUCTS:
Rubyonrails Rails,
Rubyonrails Rails
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.
AFFECTED_PRODUCTS:
Spiffyplugins Spiffy Calendar
Missing Authorization vulnerability in moveaddons Move Addons for Elementor.This issue affects Move Addons for Elementor: from n/a through 1.2.9.
AFFECTED_PRODUCTS:
Moveaddons Move Addons For Elementor
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.
AFFECTED_PRODUCTS:
Rubyonrails Rails,
Rubyonrails Rails,
Rubyonrails Rails
... (+1)
An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.
AFFECTED_PRODUCTS:
Homebrew Jan
An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.
AFFECTED_PRODUCTS:
Homebrew Jan
Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.
AFFECTED_PRODUCTS:
Homebrew Jan
Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers to execute arbitrary commands with root privileges.
AFFECTED_PRODUCTS:
Tenda O3 Firmware
Missing Authorization vulnerability in Netgsm.This issue affects Netgsm: from n/a through 2.9.19.
AFFECTED_PRODUCTS:
Netgsm Netgsm
Broken Authentication vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.93.
AFFECTED_PRODUCTS:
Softlabbd Integrate Google Drive
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VideoWhisper Picture Gallery allows Stored XSS.This issue affects Picture Gallery: from n/a through 1.5.11.
AFFECTED_PRODUCTS:
Videowhisper Picture Gallery
Missing Authorization vulnerability in RT Easy Builder – Advanced addons for Elementor.This issue affects RT Easy Builder – Advanced addons for Elementor: from n/a through 2.0.
AFFECTED_PRODUCTS:
Risethemes Rt Easy Builder
An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 2400, Exynos Modem 5123, and Exynos Modem 5300. The baseband software does not properly check states specifi...
Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
AFFECTED_PRODUCTS:
Codeparrots Easy Forms For Mailchimp
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close
AFFECTED_PRODUCTS:
Idccms Idccms
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close
AFFECTED_PRODUCTS:
Idccms Idccms
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany_deal.php?mudi=del
AFFECTED_PRODUCTS:
Idccms Idccms
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=add
AFFECTED_PRODUCTS:
Idccms Idccms
nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62...
AFFECTED_PRODUCTS:
Viz Nano Id