Advisory Catalog

Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill

Nuclei Template Signature Verification Bypass

Indico has a Cross-Site-Scripting during account creation

Drupal Open Social allows Functionality Misuse

Open Social is a Drupal distribution for online communities, which ships with an optional module called Social Embed. This module allows a website to display embedded content (such as photos or videos) when a user posts a link to that resource, without having to parse the resource directly. Added

Flask-AppBuilder's login form allows browser to cache sensitive fields

Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

This module enables field collections to be displayed as tables. It supports display suite and field permissions and provides operations (modify, delete, duplicate). This module has multiple vulnerabilities due to the requirements on the routes it provides not being restrictive enough. Information

This module enables you to "clone" a content entity, i.e. to create a new content pre-filled with data from another entity of the same type and bundle. The module doesn't properly check the user access to the original entity, allowing users to create a new entity (they have permission to create) pr

This module enables you to configure a wiki-like input filter that allows users to create links to site and external content. The module doesn't sufficiently check if a user has access to some URLs before rendering them as links. This vulnerability is mitigated by the fact that an attacker must ha

pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD

runc can be confused to create empty files/directories on the host

DOM clobbering could escalate to Cross-site Scripting (XSS)

ReDoS in urlregex

Vault Leaks Client Token and Token Accessor in Audit Devices

Adyen APIs Library for Python timing attack vulnerability

Svelte has a potential mXSS vulnerability due to improper HTML escaping

OPA for Windows has an SMB force-authentication vulnerability

Hwameistor Potential Permission Leakage of Cluster Level

OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability

FeehiCMS User[avatar] unrestricted upload

FeehiCMS BannerForm[img] unrestricted upload

FeehiCMS file upload vulnerability

Drupal Full Path Disclosure

"powermail" (powermail) Insecure Direct Object Reference (IDOR)

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

This module enables you to cache pages for logged in users at the Varnish level. The Varnish bin names may be guessable when no hashing noise configuration is set on the module configuration page, which would ultimately allow any user to view cached pages that were intended for other roles when gue

CWA-2023-004: Excessive number of function parameters in compiled Wasm

Taipy has a Session Cookie without Secure and HTTPOnly flags

AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template

Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS

FastAPI Admin Cross-site Scripting vulnerability in the Config-Create function

FastAPI Admin cross-site scripting (XSS) vulnerability in the Create Product function

req may send an unintended request when a malformed URL is provided

Hyperledger Fabric does not verify request has a timestamp within the expected time window

Automad Cross-site Scripting vulnerability

Mage AI Path Traversal vulnerability

Mage AI Path Traversal vulnerability

Mage AI Path Traversal vulnerability

request_store has Incorrect Default Permissions

Mattermost Plugin Channel Export excessive resource consumption

Mattermost allows guest user with read access to upload files to a channel

Mattermost allows team admin user without "Add Team Members" permission to disable invite URL

Casdoor has reflected XSS in QrCodePage.js (GHSL-2024-036)

Hono CSRF middleware can be bypassed using crafted Content-Type header

Mattermost doesn't redact remote users' original email addresses

Mattermost allows remote/synthetic users to create sessions, reset passwords

Mattermost Cross-Site Request Forgery vulnerability

Mattermost doesn't restrict which roles can promote a user as system admin