Advisory Catalog

Twisted vulnerable to HTML injection in HTTP redirect body

Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

ICEcoder Path Traversal vulnerability

Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar

snapd failed to restrict writes to the $HOME/bin path

snapd failed to properly check the file type when extracting a snap

Cross-Site Request Forgery in Spina

The Argo CD web terminal session does not handle the revocation of user permissions properly

OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)

ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

Ankitects Anki LaTeX Blocklist Bypass vulnerability

Anki Latex Incomplete Blocklist Vulnerability

Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places

ProcessWire Cross Site Request Forgery vulnerability

Calibre-Web Cross Site Scripting (XSS)

[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

Woodpecker's custom environment variables allow to alter execution flow of plugins

github.com/gitpod-io/gitpod vulnerable to Cookie Tossing

Sentry's Python SDK unintentionally exposes environment variables to subprocesses

Roundup Cross-site Scripting Vulnerability

Roundup Cross-site Scripting Vulnerability

Roundup Cross-site Scripting Vulnerability

BlastRADIUS also affects eduMFA

Silverstripe uses TinyMCE which allows svg files linked in object tags

Zowe CLI allows storage of previously entered secure credentials in a plaintext file

Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload

Silverstripe Reports are still accessible even when `canView()` returns false

Apache StreamPipes potentially allows creation of multiple identical accounts

Apache StreamPipes has possibility of SSRF in pipeline element installation process

Apache Airflow Potential Cross-site Scripting Vulnerability

REXML denial of service vulnerability

ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION flood in net/http

OpaMiddleware does not filter HTTP OPTIONS requests

@jmondi/url-to-png enables capture screenshot of localhost web services (unauthenticated pages)

@jmondi/url-to-png contains a Path Traversal vulnerability

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes

Red-DiscordBot vulnerable to Incorrect Authorization in commands API

A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. Th

Decidim cross-site scripting (XSS) in the admin panel

Decidim cross-site scripting (XSS) in the pagination

Decidim vulnerable to data disclosure through the embed feature

Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting

Django vulnerable to user enumeration attack

Cache driver GetBlob() allows read access to any blob without access control check

PrivateBin allows shortening of URLs for other domains

zipp Denial of Service vulnerability

Directus Blind SSRF On File Import

Khoj Open Redirect Vulnerability in Login Page