Advisory Catalog

BunkerWeb has Open Redirect Vulnerability in Loading Page

Access to Archived Argo Workflows with Fake Token in `client` mode

ibexa/post-install affected by Breach with Varnish VCL

ibexa/http-cache affected by Breach with Varnish VCL

ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

sftpgo vulnerable to brute force takeover of OpenID Connect session cookies

Traefik's X-Forwarded-Prefix Header still allows for Open Redirect

Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern

@intlify/shared Prototype Pollution vulnerability

vue-i18n has cross-site scripting vulnerability with prototype pollution

NULL Pointer Dereference on moby image history

pyspider Cross-site Scripting vulnerability

Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts

`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace

This module integrates Tarte au citron JS library with Drupal and prevent services to be loaded without user consent. Administrators can enable and configure services which will be managed by Tarte au citron. When Google Tag Manager (GTM) service is enabled, an attacker can load a GTM container tha

CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

TCPDF Local File Inclusion vulnerability

Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges

OpenShift Console Server Side Request Forgery vulnerability

smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables

Sentry improper error handling leaks Application Integration Client Secret

SFTPGo allows administrators to restrict command execution from the EventManager

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash.

Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Rancher Helm Applications may have sensitive values leaked

This module for Drupal provides complete control of Email settings with Drupal and Mailjet. In certain cases the module doesn't securely pass data to PHP's unserialize() function, which could result in Remote Code Execution via PHP Object Injection. This vulnerability is mitigated by the fact that

Drupal Core Cross-Site Scripting (XSS)

django CMS Attributes Field Cross-site Scripting

Django Filer Unrestricted Upload of File with Dangerous Type

Moodle IDOR when accessing list of course badges

Moodle Lesson activity password bypass through PHP loose comparison

Moodle allows users to retrieve information they did not have permission to access

Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata

Statamic CMS has a Path Traversal in Asset Upload

Redaxo Core CMS Cross Site Scripting (XSS)

Linux Kernel Use of Uninitialized Resource Vulnerability

aiohttp allows request smuggling due to incorrect parsing of chunk extensions

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

moodle: IDOR when fetching report schedules

moodle: Some users can delete audiences of other reports

moodle: IDOR in edit/delete RSS feed

Moodle leaks user names

django CMS Cross-Site Scripting (XSS)

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

OpenStack improperly deletes access rules

LibreNMS has a stored XSS in ExamplePlugin with Device's Notes