Advisory Catalog

Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function

python-a2a has a path traversal in the create_workflow function

pycares has a Use-After-Free Vulnerability

protobuf-python has a potential Denial of Service issue

Weblate exposes personal IP address via e-mail

Weblate lacks rate limiting when verifying second factor

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.

OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint

OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.

A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.

Salt vulnerable to directory traversal attack in file receiving method

Salt's worker process vulnerable to denial of service through file read operation

Salt's file contents overwrite the VirtKey class

Salt allows arbitrary directory creation or file deletion

Salt vulnerable to arbitrary event injection

Salt vulnerable to directory traversal attack in minion file cache creation

Salt's on demand pillar functionality vulnerable to arbitrary command injections

Salt has minion event bus authorization bypass vulnerability

Salt's salt.auth.pki module does not properly authenticate callers

Vantage6 Server JWT secret not cryptographically secure

vantage6 lacks brute-force protection on change password functionality

Nautobot may allows uploaded media files to be accessible without authentication

Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating

OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

OctoPrint vulnerable to possible file extraction via upload endpoints