Writeup Exploits
68,122 exploits tracked across all sources.
GitLab 6.0.0-6.9.2 and 7.x < 7.4.3 - Authenticated Arbitrary Group Ownership Modification via Groups API
The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.
CVSS 6.5
nimbus_jose+jwt - HMAC Bypass via Integer Overflow in Byte-to-Bit Conversion
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.
CVSS 7.5
Nimbus JOSE+JWT <4.39 - Info Disclosure
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.
CVSS 3.1
Nimbus JOSE+JWT < 4.36 - Invalid Curve Attack via ECKey Construction
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.
CVSS 7.5
Libidn2 < 2.0.3 - Integer Overflow in _isBidi Function
Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
CVSS 9.8
Libidn2 < 2.0.4 - Integer Overflow in decode_digit Function
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
CVSS 9.8
Inedo BuildMaster <5.8.2 - Info Disclosure
In Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have been used.
CVSS 9.8
FineCMS 5.2.0 - Cross-Site Scripting via DR_URI Field
dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.
CVSS 6.1
FineCMS 5.2.0 - Unauthenticated Arbitrary File Upload via SWFUpload API
v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.
CVSS 9.8
GitLab 9.4.x - Improper Certificate Validation in LDAP SSL Verification
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
CVSS 5.9
GitLab 9.4.x - Improper Certificate Validation in LDAP SSL Verification
GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announcement. This issue occurred because code was not merged. This is related to use of the omniauth-ldap library and the gitlab_omniauth-ldap gem.
CVSS 5.9
GitLab CE and EE < 9.0.11, 9.1.8, 9.2.8 - Authenticated Privilege Escalation via Group Creation
GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.
CVSS 6.3
GitLab EE < 8.17.7, 9.0.11, 9.1.8, 9.2.8, 9.3.8 - Authenticated Repository Access via Mirroring Feature
GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.
CVSS 6.5
LibTIFF 4.0.9 - Denial of Service via Null-Pointer Dereference in TIFFPrintDirectory
In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.
CVSS 6.5
openpyxl < 2.4.2 - XML External Entity Injection via Crafted .xlsx Document
Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.
CVSS 8.2
GnuTLS - Buffer Overflow
A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.
CVSS 4.0
CVE-2015-6251
WRITEUP
GnuTLS < 3.3.17 and 3.4.x < 3.4.4 - Denial of Service via Long DistinguishedName Certificate Entry
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
CVE-2015-3308
WRITEUP
GnuTLS < 3.3.14 - Use-After-Free in CRL Distribution Point Parsing
Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
CVE-2015-3308
WRITEUP
GnuTLS < 3.3.14 - Use-After-Free in CRL Distribution Point Parsing
Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
CVE-2014-8155
WRITEUP
GnuTLS < 2.9.10 - Certificate Validation Bypass via Invalid CA Certificate Dates
GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.
GnuTLS >=3.7.0 <3.8.3 - Denial of Service via Certificate Chain Validation
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.
CVSS 7.5
GnuTLS - Timing Side-Channel Attack
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
CVSS 7.5
GnuTLS - Timing Side-Channel in RSA ClientKeyExchange Handling
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.
CVSS 7.4
GnuTLS < 3.7.3 - Denial of Service via Zero-Length Input to Hash Update
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
CVSS 6.5
GnuTLS < 3.7.3 - Denial of Service via Zero-Length Input to Hash Update
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
CVSS 6.5
By Source