Business Logic Errors in pimcore/pimcore

Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.

QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c

A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.

TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection.

Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton

Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.

Satellite: Allow unintended SCA certificate to authenticate Candlepin

The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an attacker to use the SCA (simple content access) certificate for authentication with Candlepin.

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

geckodriver: DNS rebinding vulnerability

Improved Host header checks to reject requests not sent to a well-known local hostname or IP, or the server-specified hostname.

Keycloak: Incorrect authorization allows unpriviledged users to create other users

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

kube-reporting/hive: Incomplete fix for log4j CVE-2021-44228 and CVE-2021-45046

It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6.

Cross-site Scripting (XSS) - Stored in meetecho/janus-gateway

janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

snapd could be made to bypass intended access restrictions through snap content interfaces and layout paths

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor policy rules via malformed content interface and layout declarations and hence escape strict snap confinement. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Improper Access Control in bookstackapp/bookstack

bookstack is vulnerable to Improper Access Control

Deserialization of Untrusted Data in pytorchlightning/pytorch-lightning

pytorch-lightning is vulnerable to Deserialization of Untrusted Data

Business Logic Errors in yetiforcecompany/yetiforcecrm

yetiforcecrm is vulnerable to Business Logic Errors

Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')