Advisory Catalog

Stored XSS using two files in usememos/memos

MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

CSRF leading to delete account in wallabag/wallabag

Improper Authorization in dolibarr/dolibarr

Cross-site Scripting (XSS) - DOM in janeczku/calibre-web

Improper Access Control in janeczku/calibre-web

Generation of Error Message Containing Sensitive Information in janeczku/calibre-web

Cross site scripting in sylius/sylius

An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other maliciou

ReDoS in giskard's transformation.py (GHSL-2024-324)

Missing ratelimit on passwrod resets in zenml

Salt preflight script could be attacker controlled

The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (public, private, etc). This module accepts any uploaded file extension, including dangerous file formats so it can be used to bypass the allow\_insecu

decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds

UnoPim Stored XSS : Cookie hijacking through Create User function

Moodle IDOR when accessing list of badge recipients

dom-iterator code execution vulnerability

Citrix Session Recording Deserialization of Untrusted Data Vulnerability

Citrix Session Recording Improper Privilege Management Vulnerability

Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

Ansible-Core vulnerable to content protections bypass

Orchid Platform has Method Exposure Vulnerability in Modals

Moodle reflected XSS via H5P error message

Moodle Cross-site Scripting vulnerability

Moodle has insufficient capability checks

Moodle's user/power level management inconsistent with suspended users

Moodle authorization headers preserved between "emulated redirects"

Moodle has insufficient access control

Moodle has user information visibility control issues in gradebook reports

Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data

Froala WYSIWYG editor allows cross-site scripting (XSS)

Hashicorp Nomad Incorrect Authorization vulnerability

UnoPim Cross-site Scripting vulnerability

Gradio vulnerable to arbitrary file read with File and UploadButton components

This module enables you to add any HTML content you want in a tooltip displayed on mouse hover. The module does not sufficiently escape the markup inserted in the tooltip block. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".

Symfony vulnerable to open redirect via browser-sanitized URLs

Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient

ansible-core Incorrect Authorization vulnerability

OctoPrint has API key access in settings without reauthentication

OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

gradio Server Side Request Forgery vulnerability

Safearchive Path Traversal vulnerability

changedetection.io Path Traversal

Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision

Gnark out-of-memory during deserialization with crafted inputs

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability

Hashicorp Consul Cross-site Scripting vulnerability

Integrates your Drupal website with the Oh Dear monitoring app. Cached data of monitoring results is accessible to non-logged in users when caching is enabled on the module. This vulnerability is mitigated by the fact that it only affects sites where caching is enabled for OhDear report healthchec

This module makes it possible for you to integrate Cookiebot and Google Tag Manager in a fast and simple way. The module doesn't sufficiently filter for malicious script leading to a persistent cross site scripting (XSS) vulnerability.