A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28246
https://github.com/formio/enterp…
OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-34081
https://advisory.checkm…
lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project’s package.json file.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-34078
https://github.com/lifion/lifion-verify…
OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the ‘ports’ entry of a crafted docker-compose.yml file.
References
https://nvd.nist.gov/vuln/detail/CVE…
An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
References
https://nvd.nist.gov/vuln/detail/…
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
References
https://nv…
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be go…
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be go…
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be go…
Impact
The malicious user is able to update a crafted config file into repository’s .git directory with to gain SSH access to the server. All installations with repository upload enabled (default) are affected.
Patches
Repository file updates are prohi…
