Advisory Catalog

NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system

Express ressource injection

In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint,

Mattermost Server allows user to get private channel names

Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery

Mattermost Server vulnerable to application crash from attacker-generated large response

Mattermost server allows authenticated user to delete arbitrary post

Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')

Argo Workflows Controller: Denial of Service via malicious daemon Workflows

MPXJ has a Potential Path Traversal Vulnerability

REXML ReDoS vulnerability

Funadmin Cross-site Scripting vulnerability

Werkzeug possible resource exhaustion when parsing file data in forms

Werkzeug safe_join not safe on Windows

Denied Host Validation Bypass in Zitadel Actions

Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse

The Snowflake Connector for Python stores sensitive data in logs

A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSanitizer. The crash occurred due to a read access to an invalid memory address (0x1000c9714971).

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a n

A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files.

Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

ai-admin-graphql has a Denial of service vulnerability in SaaS and marketplace setups

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature

baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature

Cisco ASA and FTD Denial-of-Service Vulnerability

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. In certain cases the module doesn't sufficiently sanitize data before passing it to PHP's unserialize() function, which can result in arbitrary code execution.

This module enables you to animate an SVG graphic by selecting certain rows in a view. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload SVG files.

This module enables you to embed the content of an SVG file into the body html of a node and optionally allows to translate text contained within the image. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an

camaleon_cms affected by cross site scripting

Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present

Flair allows arbitrary code execution

Path traversal in redaxo

Admidio Vulnerable to HTML Injection In The Messages Section

Drupal core vulnerable to improper error handling

Possible ReDoS vulnerability in block_format in Action Mailer

Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

Possible ReDoS vulnerability in HTTP Token authentication in Action Controller

Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

Infinite loop in github.com/gomarkdown/markdown

VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder

Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Valid ECDSA signatures erroneously rejected in Elliptic

Cross site scripting in markdown-to-jsx

OpenCanary Executes Commands From Potentially Writable Config File

DOM Clobbering Gadget found in astro's client-side router that leads to XSS

KubeSphere IDOR vulnerability

Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.

Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint