Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,050 results · page 31 of 61
Feb 8, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-0742 · Other software · answerdev · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-0741 · Other software · answerdev · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-0740 · Other software · answerdev · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4.CVE-2023-0739 · Other software · answerdev · reported by security@huntr.devMedium 6.8
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4.
- Product
- answerdev/answer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-0736 · Other software · wallabag · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
- Product
- wallabag/wallabag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2023Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.CVE-2023-0735 · Other software · wallabag · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
- Product
- wallabag/wallabag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.CVE-2023-0678 · Websites & servers · phpipam · reported by security@huntr.devMedium 5.3
Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.CVE-2023-0677 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.CVE-2023-0676 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
- Product
- phpipam/phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0671 · Other software · froxlor · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023CKAN is an open-source DMS (data management system) for powering data hubs and data portals.CVE-2023-22746 · Other software · ckan · reported by GitHubHigh 8.6
CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret key in their own `.env` file are not affected by this issue. Note that the legacy images (ckan/ckan) located in the main CKAN repo are not affected by this issue. The affected images are ckan/ckan-docker, (ckan/ckan-base images), okfn/docker-ckan (openknowledge/ckan-base and openknowledge/ckan-dev images) keitaroinc/docker-ckan (keitaro/ckan images).
- Product
- ckan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.CVE-2023-0643 · Other software · squidex · reported by security@huntr.devMedium 6.1
Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.
- Product
- squidex/squidex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.CVE-2023-0642 · Other software · squidex · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.
- Product
- squidex/squidex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.CVE-2023-0610 · Other software · wallabag · reported by security@huntr.devMedium 4.3
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
- Product
- wallabag/wallabag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.CVE-2023-0609 · Other software · wallabag · reported by security@huntr.devMedium 4.3
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
- Product
- wallabag/wallabag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.CVE-2023-0608 · Other software · microweber · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.CVE-2023-0607 · Other software · projectsend · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.
- Product
- projectsend/projectsend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.CVE-2023-0606 · Other software · ampache · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7.
- Product
- ampache/ampache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2023Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.CVE-2023-0512 · Other software · vim · reported by security@huntr.devHigh 7.8
Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 29, 2023Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0572 · Other software · froxlor · reported by security@huntr.devMedium 5.3
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2023Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0565 · Other software · froxlor · reported by security@huntr.devMedium 5.5
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2023Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.CVE-2023-0569 · Other software · publify · reported by security@huntr.devMedium 6.5
Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.
- Product
- publify/publify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2023Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.CVE-2023-0564 · Other software · froxlor · reported by security@huntr.devMedium 5.4
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
- Product
- froxlor/froxlor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-0519 · Other software · modoboa · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.CVE-2023-0493 · Other software · btcpayserver · reported by security@huntr.devMedium 5.3
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
- Product
- btcpayserver/btcpayserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 26, 2023Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.CVE-2023-0509 · Other software · pyload · reported by security@huntr.devHigh 7.4
Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
- Product
- pyload/pyload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.CVE-2023-0488 · Other software · pyload · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
- Product
- pyload/pyload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-0470 · Other software · modoboa · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.CVE-2023-0455 · Other software · unilogies · reported by security@huntr.devHigh 8.8
Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.
- Product
- unilogies/bumsys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 26, 2023Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted CVE-2023-24442 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.5
Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
- Product
- Jenkins GitHub Pull Request Coverage Status Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentiaCVE-2023-24436 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- Product
- Jenkins GitHub Pull Request Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacCVE-2023-24435 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins GitHub Pull Request Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-spCVE-2023-24434 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins GitHub Pull Request Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C.CVE-2023-22486 · Other software · github · reported by GitHubLow 3.5
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to seCVE-2023-0229 · Other software · Redhat · reported by Red HatMedium 6.3
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.
- Product
- Openshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jan 23, 2023cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C.CVE-2023-22485 · Other software · github · reported by GitHubMedium 5.3
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document can trigger an out-of-bounds read in the `validate_protocol` function. We believe this bug is harmless in practice, because the out-of-bounds read accesses `malloc` metadata without causing any visible damage.This vulnerability has been patched in 0.29.0.gfm.7.
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C.CVE-2023-22484 · Other software · github · reported by GitHubLow 3.5
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability has been patched in 0.29.0.gfm.7.
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C.CVE-2023-22483 · Other software · github · reported by GitHubLow 3.5
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exhaustion and subsequent denial of service. Various commands, when piped to cmark-gfm with large values, cause the running time to increase quadratically. These vulnerabilities have been patched in version 0.29.0.gfm.7.
- Product
- cmark-gfm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.CVE-2023-0440 · Other software · healthchecks · reported by security@huntr.devMedium 5.3
Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.
- Product
- healthchecks/healthchecks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-0438 · Other software · modoboa · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2023Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.CVE-2023-0435 · Other software · pyload · reported by security@huntr.devCritical 9.8
Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.
- Product
- pyload/pyload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2023Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.CVE-2023-0434 · Other software · pyload · reported by security@huntr.devHigh 7.5
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
- Product
- pyload/pyload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2023Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.CVE-2023-0433 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Jan 20, 2023act is a project which allows for local running of github actions.CVE-2023-22726 · Other software · nektos · reported by GitHubHigh 8
act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege escalation. The /upload endpoint is vulnerable to path traversal as filepath is user controlled, and ultimately flows into os.Mkdir and os.Open. The /artifact endpoint is vulnerable to path traversal as the path is variable is user controlled, and the specified file is ultimately returned by the server. This has been addressed in version 0.2.40. Users are advised to upgrade. Users unable to upgrade may, during implementation of Open and OpenAtEnd for FS, ensure to use ValidPath() to check against path traversal or clean the user-provided paths manually.
- Product
- act
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verCVE-2021-26642 · Other software · XEHub · reported by vuln@krcert.or.krHigh 8.8
When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.
- Product
- XE3 XpresesEngine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.CVE-2023-0410 · Other software · builderio · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.
- Product
- builderio/qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-0406 · Other software · modoboa · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-0398 · Other software · modoboa · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
- Product
- modoboa/modoboa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV.CVE-2023-0358 · Other software · gpac · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository gpac/gpac prior to 2.3.0-DEV.
- Product
- gpac/gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service.CVE-2022-23538 · Other software · sylabs · reported by GitHubMedium 5.2
github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow. Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow. We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke
- Product
- scs-library-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.