Advisory Catalog

Cross-site Scripting in invenio-previewer

Cross-site scripting invenio-records

Invenio-App vulnerable to host header injection attack

Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS

Twisted CRLF Injection

Django Cross-site Scripting in AdminURLFieldWidget

PyDio Stored XSS Vulnerability

Capstone SEGV caused by a read memory access

Mercurial Path Traversal/Link Following vulnerability

Matrix Sydent mishandles emails

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Improper Neutralization of CRLF Sequences in urllib3 library for Python

Apache Airflow vulnerable to Stored XSS

Moderate severity vulnerability that affects roundup

Jupyter Notebook open redirect vulnerability

Open Redirect vulnerability in jupyterhub and notebook

Ansible Path Traversal vulnerability

Improper Neutralization of Input During Web Page Generation in Jupyter Notebook

Apache Airflow vulnerable to Stored XSS

Pyspark User Impersonation Vulnerability

Buildbot CRLF Injection

CRLF Injection in pypiserver

Bodhi Cross-site Scripting Vulnerability

** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should

There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

Improper Neutralization of Input During Web Page Generation in LXML

Ansible Logs Passwords If PowerShell ScriptBlock is Enabled

Jupyter Notebook XSS via untrusted notebooks

Jupyter Notebook XSS via directory name

SaltStack Salt Directory Traversal vulnerability in salt-api

Ajenti Cross-site Scripting Via Filename

Moderate severity vulnerability that affects moin

Django allows unprivileged users to read the password hashes of arbitrary accounts

In marshmallow library the schema "only" option treats an empty list as implying no "only" option

Openstack Neutron vulnerable to eavesdropping on private traffic

Flask-Admin Cross-site Scripting vulnerability

mayan-edms Cross-site Scripting vulnerability

Moderate severity vulnerability that affects mayan-edms

Moderate severity vulnerability that affects mayan-edms

Cobbler Arbitrary File Read

Cobbler XSS Vulnerability

Withdrawn Advisory: Pulp Improper Path Parsing

Cloudtoken Insufficiently Protects Credentials

Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint

Django open redirect

OpenStack Neutron Race Condition vulnerability

Improper Input Validation in ansible