Advisory Catalog

XSS in python-markdown2

Possible XSS attack in Wagtail

python-apt Does Not Check Hash Signature

python-apt Flawed Package Integrity Check

Vyper interfaces returning integer types less than 256 bits can be manipulated if uint256 is used

Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag

Malicious package may avoid detection in python auditing

Path Traversal in Ansible

Incorrect Permission Assignment for Critical Resource in Ansible

Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible

Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible

Forced Browsing in Twisted

Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File

XSS in Bleach when noscript and raw tag whitelisted

Ansible Sensitive Files Are Locally Readable

Ansible sets unsafe permissions for sources.list

Ansible discloses credential information

Catastrophic backtracking in regex allows Denial of Service in Waitress

Multiple cross-site scripting (XSS) vulnerabilities in Roundup

Information disclosure in Apache Superset

Missing Authentication for Critical Function in Saleor

Plone Open Redirect Vulnerability

Plone cross site scripting (XSS)

Cross-site scripting in markdown2 for python

Client Denial of Service on TUF

XSS in Apache Airflow

Plone Zope cross-site scripting (XSS) vulnerability

Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible

In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page.

Users able to query database metadata in Apache Superset

Users can view database names in Apache Superset

pyrad uses sequential packet IDs

Out-of-bounds Read in OpenCV

FreeIPA logs passwords embedded in commands in calls using batch

OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor

Zope XSS Vulnerability

Designate does not enforce the DNS protocol limit concerning record set sizes

Link Following in rply

OpenStack Keystone and other components vulnerable to Improper Certificate Validation

Cross-site scripting in Jupyter Notebook

Apache Airflow vulnerable to XSS and local file disclosure

Mercurial Improper Certificate Validation vulnerability

Ansible leaks sensitive information to logs when told not to

wolfCrypt leaks cryptographic information via timing side channel

Out-of-bounds Read in OpenCV

Divide By Zero in OpenCV.

Cross-site Scripting in django-js-reverse

Cross-site scripting in recommender-xblock

Exposure of Sensitive Information to an Unauthorized Actor in ansible

Cross-site Scripting in invenio-communities