Advisory Catalog

Red-DiscordBot vulnerable to Incorrect Authorization in commands API

A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. Th

Django vulnerable to user enumeration attack

zipp Denial of Service vulnerability

Khoj Open Redirect Vulnerability in Login Page

Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

Weblate vulnerable to improper sanitization of project backups

Reflected Cross-Site Scripting (XSS) in zenml

litellm vulnerable to improper access control in team management

Directory creation by malicious user in saltstack

CodeChecker has a Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`

Improper line feed handling in zenml

Remote Code Execution in create_conda_env function in lollms

Open redirect in gradio

Apache Superset server arbitrary file read

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

Apache Airflow does not return the "Cache-Control" header for dynamic content

Invenio-Communities has a Cross-Site Scripting (XSS) vulnerability in React components

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Tornado has a CRLF injection in CurlAsyncHTTPClient headers

Arbitrary system path lookup in h20

SQL injection in litellm

scikit-learn sensitive data leakage vulnerability

Undefined Behavior in mlflow

Clickjacking in zenml

Improper authorization in zenml

Cross site scripting in zenml

Denial of service in langchain-community

Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints

Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

path traversal vulnerability was identified in the parisneo/lollms-webui

code injection vulnerability exists in the huggingface/text-generation-inference repository

Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects

dbt allows Binding to an Unrestricted IP Address via socketsocket

rockhopper Buffer Overflow vulnerability

jupyter-scheduler's endpoint is missing authentication

OMERO.web must check that the JSONP callback is a valid function

Requests `Session` object does not verify requests after making first request with verify=False

aiosmtpd STARTTLS unencrypted commands injection

MLflow allows low privilege users to delete any artifact

Scrapy allows redirect following in protocols other than HTTP

Scrapy's redirects ignoring scheme-specific proxy settings

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Apache Superset Incorrect Authorization vulnerability

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Nebari prints temporary Keycloak root password

Gradio's Component Server does not properly consider` _is_server_fn` for functions

Ryu Infinite Loop vulnerability