Advisory Catalog

hnswlib Double Free vulnerability

PyPDF2 quadratic runtime with malformed PDF missing xref marker

PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects

pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL (which may be realistic within enterprise security products).

pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a character

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

gRPC connection termination issue

Synapse has URL deny list bypass via oEmbed and image URLs when generating previews

Synapse has improper checks for deactivated users during login

MindSpore vulnerable to memory corruption

Open redirect in Tornado

Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites

Unintended leak of Proxy-Authorization header in requests

Incorrect signature verification in django-ses

kiwitcms vulnerable to stored XSS via unrestricted files upload

Vyper's nonpayable default functions are sometimes payable

transformers has Insecure Temporary File

in-toto: PGP trust model not (fully) considered

in-toto vulnerable to Configuration Read From Local Directory

Apache Airflow vulnerable to stored Cross-site Scripting

kiwi TCMS has possibility for user to update email address to unverified one

Apache Superset vulnerable to Exposure of Sensitive Information

pretalx allows path traversal in HTML export

Apache Superset vulnerable to Improper Authorization

Apache Superset Server-Side Request Forgery vulnerability

Allegro Tech BigFlow vulnerable to Missing SSL Certificate Validation

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

configobj ReDoS exploitable by developer using values in a server-side configuration file

pgAdmin 4 vulnerable to directory traversal

TensorFlow Denial of Service vulnerability

redis-py Race Condition vulnerability

Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

tripleo-ansible may disclose important configuration details from an OpenStack deployment

tripleo-ansible may disclose important configuration details from an OpenStack deployment

Streamlit publishes previously-patched Cross-site Scripting vulnerability

Sensitive Information in Error Messages in Apache Airflow

WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.

WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.

Cross-site Scripting in django-ajax-utilities

openstack-neutron uncontrolled resource consumption flaw

Open redirect in web2py

Saleor Unauthenticated Information Disclosure Vulnerability via Python Exceptions

Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions

vantage6 vulnerable to Observable Response Discrepancy

modoboa Cross-site Scripting vulnerability

Stored cross site scripting in changedetection.io

Mayan EDMS DMS XSS vulnerability

Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf

Exposure of Sensitive Information in EVE-SRP