Advisory Catalog

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP

RestrictedPython information leakage via `AttributeError.obj` and the `string` module

Inefficient Regular Expression Complexity in langflow

Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function.

Heap-based Buffer Overflow in sqlite-vec

Cross-Site Request Forgery (CSRF) in strawberry-graphql

OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing attack.

OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.

OAuth2 client ID and secret exposed through the web browser

A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the "Top banner" field. NOTE: Multiple third parties h

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supp

Prevent XSS from Confidant API call