All CVEs — page 275 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A vulnerability in Backstage's scaffolder actions allows authenticated users to make the backend contact unintended destinations and leak Sentry integration credentials. This could lead to unauthorized access to Sentry resources and potential credential exposure.
The flaw allows authenticated attackers with control over TechDocs source repositories to inject arbitrary network requests during documentation builds, potentially enabling data exfiltration from internal networks reachable by the build environment. This represents a significant information disclosure risk in developer portal deployments.
A heap-based buffer overflow in GIMP's DDS image loader occurs when processing crafted images with oversized dimensions, leading to integer overflow in buffer size calculations that results in heap corruption and potential arbitrary code execution.
The flaw allows an authenticated actor to execute arbitrary code by manipulating configuration values in the agent import functionality, posing a critical risk.
Ghostscript can be tricked into executing arbitrary shell commands by parsing specially crafted PostScript or EPS documents, bypassing its security sandbox. This allows attackers to gain full control over the Ghostscript process and potentially compromise all data accessible to it.
Gitea's workflow engine was vulnerable to a denial-of-service attack where a malicious user could create a pull request with a matrix strategy that expands into a huge number of jobs, consuming server memory and potentially crashing the process. This vulnerability affects the workflow processing logic before pull request approval gates are applied.
Gitea's web installer fails to verify passwords when creating admin sessions for existing accounts, allowing attackers to gain full administrative access without knowing the password. This affects installations where the INSTALL_LOCK flag was reset to false.
A Gitea repository's external issue tracker configuration with alternating capture groups in regular expressions can cause runtime panics when rendering issue references, leading to complete service termination. An attacker with repository edit access can crash the entire Gitea instance by crafting malicious regex patterns.
This flaw allows a contributor to push Git trees with duplicate names, leading to inconsistent content when checked out or used in CI processes, potentially exposing sensitive data.
The flaw allows for unauthorized execution of workflows in the base repository through fork pull requests, bypassing approval requirements.
Gitea allows administrators to set up push mirrors that initially validate remote addresses against allow/block lists, but subsequent synchronizations use the stored address without re-validation, potentially allowing pushes to internal/protected Git services. This creates a privilege escalation vector where users can force-push repository contents to arbitrary internal repositories.