Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.
The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to int…
Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-31264
https://github.com/Ainevsia/CVE-Request/tree…
The route lookup process in beego through 1.12.4 and 2.x through 2.0.2 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).
Referen…
WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-28990
https://github.com/wasm3/wasm3/issues/323
https://github.com/wasm3/wasm3/pull/324
https://github.co…
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. A complete denial of service can be achived by sending the malicious form in a loop.
References
https://nvd.nist.gov/vul…
All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-21195
https://github.com/AlexFlipnote/url_regex/blob/master/u…
Impact
Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).
Patches
Update to Contao 4.13.3.
Workarounds
Disable canonical tags in the root page settings.
References
https://contao.org/en…
The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level.
In multi-te…
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the…
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users…
