Advisory Catalog

Concrete CMS Stored Cross-site Scripting vulnerability

In aiohttp, compressed files as symlinks are not protected from path traversal

Concrete CMS Stored XSS in getAttributeSetName

CosmWasm wasmd has large address count in ValidateBasic

Gas mispricing in cosmwasm-vm

Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

Open WebUI Stored Cross-Site Scripting Vulnerability

The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning paths, by combining together modules, courses, and other activities, ordering them, and defining conditional rules for the transitions from one step to the next one. An administration

Gorush uses deprecated TLS versions

Qwik has a potential mXSS vulnerability due to improper HTML escaping

Microweber Reflected Cross-site scripting (XSS) vulnerability

Matrix SDK for React's URL preview setting for a room is controllable by the homeserver

Meshery SQL Injection vulnerability

Meshery SQL Injection vulnerability

gotortc Cross-site Scripting vulnerability

gotortc Cross-site Scripting vulnerability

memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta

memos vulnerable to Server-Side Request Forgery and Cross-site Scripting

memos vulnerable to Server-Side Request Forgery in /api/resource

lorawan-stack Open Redirect vulnerability

nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR

Microweber Cross Site Scripting (XSS) vulnerability

Microweber Cross Site Scripting (XSS) vulnerability

In regclient, pinned manifest digests may be ignored

APM Server vulnerable to Insertion of Sensitive Information into Log File

openstack-heat may disclose sensitive information

REXML DoS vulnerability

Elliptic's ECDSA missing check for whether leading bit of r and s is zero

Elliptic's EDDSA missing signature length check

REXML DoS vulnerability

Navidrome uses MD5 hashing algorithm

Concrete CMS vulnerable to Stored Cross-site Scripting

casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification

Bostr Improper Authorization vulnerability

Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling

Mattermost allows a user on a remote to set their remote username prop to an arbitrary string

Mattermost allows a remote actor to make an arbitrary local channel read-only

Mattermost allows remote actor to set arbitrary RemoteId values for synced users

Mattermost failed to properly validate synced reactions

Mattermost failed to disallow the modification of local users when syncing users in shared channels

ZITADEL "ignoring unknown usernames" vulnerability

ZITADEL has improper HTML sanitization in emails and Console UI

MobSF vulnerable to Open Redirect in Login Redirect

PheonixAppAPI has visible Encoding Maps

eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes. The module doesn't validate the content of classes. A malicious user with access to

Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

Bolt CMS Cross-site Scripting vulnerability

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

Aim Stored Cross-site Scripting Vulnerability