Advisory Catalog

Bots using py-cord as Discord API wrapper are vulnerable to shutdowns through remote code execution

Remote code execution in Apache Airflow Docker's Provider

OctoPrint does not have rate limiting on the login page

django-sendfile2 before 0.7.0 contains reflected file download vulnerability

Django vulnerable to Reflected File Download attack

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

chia-blockchain tokens can be inflated to an arbitrary extent

untangle vulnerable to Improper Restriction of XML External Entity Reference

untangle vulnerable to XML Entity Expansion

Mistune vulnerable to catastrophic backtracking

Apache MXNet vulnerable to potential denial-of-service by excessive resource consumption

Apache Spark UI can allow impersonation if ACLs enabled

Codecov does not sanitize gcov arguments

mat2 before 0.13.0 allows directory traversal during the ZIP archive cleaning process.

Incorrect handling of invalid surrogate pair characters

In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the

lxml NULL Pointer Dereference allows attackers to cause a denial of service

URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths

SystemDS CPU exhaustion vulnerability

Salt's PAM auth fails to reject locked accounts

XSS Vulnerability in Markdown Editor

CSV Injection in inventree

Unrestricted Attachment Upload

Insufficient HTML Sanitization

Jupyter server Token bruteforcing

Command Injection in Nuitka

Cross Site Scripting vulnerability in django-jsonform's admin form.

Multiple evaluation of contract address in call in vyper

Phoenix-ws source code and data in extensions folder is publicly available

Flower OAuth authentication bypass

Uncaught Exception (due to a data race) leads to process termination in Waitress

Key confusion through non-blocklisted public key formats

Code injection in `saved_model_cli` in TensorFlow

Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlow

Regular expression denial of service in url_regex

Buffer overflow in wasm3

Cross-site Scripting in OctoPrint

Cross-site Scripting in OctoPrint

Out-of-bounds read in admesh

Server-Side Request Forgery in scout-browser

Path Traversal in scout-browser

Apache Doris hardcoded key and IV

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

Improper Authentication in django-mfa3

Incorrect Comparison in Vyper

Sensitive Auth & Cookie data stored in Jupyter server logs

Improper Removal of Sensitive Information Before Storage or Transfer in irrd

Uncontrolled Resource Consumption in Apache DolphinScheduler

SaltStack Improper Verification of Cryptographic Signature

SaltStack Salt Authentication Bypass by Capture-replay