Advisory Catalog

Zope management interface vulnerable to stored cross site scripting via the title property

pretix potential IP address spoofing vulnerability

matrix-synapse vulnerable to improper validation of receipts allows forged read receipts

OpenStack Barbican information disclosure vulnerability

OpenStack Barbican credential leak flaw

Zope vulnerable to Stored Cross Site Scripting with SVG images

plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images

Vyper has incorrect re-entrancy lock when key is empty string

Gradio arbitrary file upload vulnerability

Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration

Apache Airflow Incorrect Authorization vulnerability

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down

Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Apache Superset Improper Input Validation vulnerability

Apache Superset Deserialization of Untrusted Data vulnerability

Apache Superset has incorrect authorization check

Apache Superset may expose internal traces on REST API endpoints

Apache Superset Server Side Request Forgery vulnerability

Apache Superset has improper default REST API permission for Gamma users

Apache Superset users may incorrectly create resources using the import charts feature

Apache Superset vulnerable to improper data authorization

Salt vulnerable to denial of service

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

incorrect order of evaluation of side effects for some builtins

Vyper: reversed order of side effects for some operations

GitPython blind local file inclusion

Archive spoofing vulnerability in borgbackup

Open Redirect Vulnerability in jupyter-server

cross-site inclusion (XSSI) of files in jupyter-server

Pyramid static view path traversal up one directory

Apache Airflow missing Certificate Validation

Horizon Web Dashboard Open Redirect vulnerability

Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users

Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint

The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the

Sentry vulnerable to incorrect credential validation on OAuth token requests

wger Workout Manager Cross-site Scripting vulnerability

RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling

copyparty vulnerable to reflected cross-site scripting via k304 parameter

ecrecover can return undefined data if signature does not verify

Denial of service in neutron

copyparty vulnerable to reflected cross-site scripting via hc parameter

Indico vulnerable to Cross-Site-Scripting via confirmation prompts

keylime fails to flag device as untrusted when signature does not validate

Pygments vulnerable to ReDoS

Fides Webserver Vulnerable to SVG Bomb File Uploads

Fides Webserver Vulnerable to Zip Bomb File Uploads

Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.

Sentry CORS misconfiguration

Withdrawn: scipy memory leak vulnerability