Advisory Catalog

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

CWA-2024-006: wasmd non-deterministic module_query_safe query

This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths. The module doesn't respect custom node access restrictions implemented through hook\_ENTITY\_TYPE\_access hooks meaning the titles of restricted

CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover

Apache Airflow Cross-site Scripting Vulnerability

Default installation of `synthetic-monitoring-agent` exposes sensitive information

Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability

Potential access to sensitive URLs via CKAN extensions (SSRF)

CKAN has Cross-site Scripting vector in the Datatables view plugin

CKAN may leak Solr credentials via error message in package_search action

Exposure of debug and metrics endpoints in Pomerium

Openshift Console insufficient entropy vulnerability

Withdrawn Advisory: Kanister vulnerable to cluster-level privilege escalation

Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

Grafana plugin data sources vulnerable to access control bypass

Ghost's improper authentication allows access to member information and actions

matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor

fugit parse and parse_nat stall on lengthy input

Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API

Gateway API route matching order contradicts specification

Policy bypass for Host Firewall policy due to race condition in Cilium agent

Directus has an insecure object reference via PATH presets

Directus has a DOM-Based cross-site scripting (XSS) via layout_options

Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking

Trix has a cross-site Scripting vulnerability on copy & paste

WebOb's location header normalization during redirect leads to open redirect

Magento Improper Access Control Leads to Privilege escalation

Magento Improper Authorization vulnerability

Magento Improper Authorization leads to Security feature bypass

Magento Improper Authorization leads to Security feature bypass

Magento Improper Authorization Leading to Security feature bypass

Magento Improper Access Control Leads to Privilege escalation

Magento Improper Authorization vulnerability

Magento Open Source Improper Authorization vulnerability

Magento Improper Authorization leads to security feature bypass

Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability

Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability

Magento Open Source Cross-Site Request Forgery vulnerability

Magento Improper Authorization vulnerability

Magento Open Source Path Traversal vulnerability

Magento Improper Authorization vulnerability

Magento Improper Authorization vulnerability

open-telemetry has an Observable Timing Discrepancy

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Path traveral in Streamlit on windows

Apache Answer: The link for resetting user password is not Single-Use

Apache Answer: The link to reset the user's password will remain valid after sending a new link

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Concrete CMS vulnerable to Stored Cross-site Scripting

Concrete CMS Stored Cross-site Scripting vulnerability