Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A vulnerability in ApostropheCMS allows any authenticated user to enumerate slugs across the system via the doc/slugTaken endpoint, exposing the existence of private, draft, and administrative content.
ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.
A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.
A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.
A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.
In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.
OGNL's stricter-invocation block list can be bypassed using reflection proxies. Only applications evaluating untrusted expressions with default permissive member access and relying solely on the block list as a sandbox are affected.
A command injection vulnerability in virtualenv's activate.fish script allows arbitrary command execution if an environment path or prompt contains a backslash before a quote. Fixed in version 21.14.2.
A vulnerability in pypdf allows an attacker to cause an infinite loop by providing a crafted PDF when an object, such as an outline item, is removed from a tree.
A vulnerability in pypdf allows attackers to craft a malicious PDF document that triggers an infinite loop when processing outline items, potentially causing a denial of service.
A vulnerability in virtualenv activation scripts allows arbitrary code execution if an environment path or prompt contains placeholder names. Activating a maliciously crafted virtual environment can cause the generated script to execute unintended commands.
A vulnerability in pypdf allows attackers to trigger excessive memory consumption by supplying crafted PDF streams configured with numerous or data-heavy filters.
A vulnerability in Vite allows cross-origin script execution when a development server passes an unmodified request URL to custom middleware. An attacker can direct a user to a malicious site that executes arbitrary scripts within the context of the development server page.
In Vite dev servers running on Node.js or Deno, specially crafted requests can disclose the initial bytes of arbitrary files outside the configured access boundaries through WebAssembly parser error messages.
In Vite on non-Windows systems, an issue allows files outside the configured root to be served if a project imports a path matching an absolute system path and the development server is exposed to the network. Updating to a patched version resolves the issue.
An unauthenticated resource exhaustion vulnerability in ApostropheCMS allows remote attackers to trigger large chunked upload processing and cleanup operations without authentication, potentially leading to denial of service.
A heap buffer overflow vulnerability in Pillow allows attackers to cause out-of-bounds writes when decoding specially crafted lossless JPEG images using draft scaling. This issue occurs when libjpeg-turbo silently ignores scaling requests, leading to memory corruption or crashes.
The A2A Java SDK writes client push notification bearer tokens and authentication credentials to server logs in cleartext upon protobuf parse errors, allowing users with log access to view secrets.
A vulnerability in the A2A Java SDK allows an untrusted or compromised agent to specify a custom HTTP header name for client credentials. When following an HTTP redirect, the HTTP client can forward these custom headers to a third-party server, potentially leaking client API keys.
A stored cross-site scripting vulnerability in Cachet allows authenticated users to inject malicious code via incident name and message fields. This script executes in the browsers of users viewing the public status page, potentially enabling session cookie theft, unauthorized redirection, and account takeover.
Unbounded recursion in Pillow when parsing PDF page trees or trailer chains can cause severe CPU and memory exhaustion or crashes during PDF append operations.
An issue in Pillow allows a maliciously crafted GIF to cause excessive memory allocation when an application handles decompression errors during frame seeking and reuses the image object. This can lead to memory exhaustion and denial of service.
Pillow is vulnerable to an out-of-bounds write when processing zero-width PPM or PGM images during morphology operations. Opening a specially crafted image can cause an application crash and potential memory corruption.
An out-of-bounds read vulnerability in Pillow's tiled-TIFF decoder can allow a specially crafted TIFF image to crash the process or expose adjacent heap memory into the decoded pixel buffer.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.