Advisory Catalog

OpenStack Keystone has an Incorrect Authorization issue

OpenStack Keystone has an Authorization Bypass

OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential

compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

pypdf: Manipulated XMP metadata streams can exhaust RAM

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

pypdf: Possible large memory usage for large offsets for layout mode text

compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

Langroid has Prompt to SQL Injection, Leading to RCE

pretix vulnerable to Authorization Bypass Through User-Controlled Key

Gradio contains a cookie injection vulnerability

Taipy contains a path traversal vulnerability

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exce

OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body

GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow

OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAdd

Bugsink: Project scoping missing in sourcemap and debug-file lookup

Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known

Bugsink: Issue event views can show an event from another project if its UUID is known

vllm has Improper Resource Shutdown or Release

Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability

Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default