Advisory Catalog

sqlparse parsing heavily nested list leads to Denial of Service

Constallation has pods exposed to peers in VPC

Pydantic regular expression denial of service

NiceGUI allows potential access to local file system

Dusk plugin may allow unfettered user authentication in misconfigured installs

Mautic Sensitive Data Exposure due to inadequate user permission settings

Mautic SQL Injection in dynamic Reports

Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder

Traefik vulnerable to denial of service with Content-length header

timber/timber vulnerable to Deserialization of Untrusted Data

Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode

Potential DoS via the Tudoor mechanism in eventlet and dnspython

Summernote vulnerable to cross-site scripting

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`open

Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations

@fastify/secure-session: Reuse of destroyed secure session cookie

Magento Open Source allows Cross-Site Scripting (XSS)

Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability

gin-vue-admin background arbitrary code coverage vulnerability

Contao: Remember-me tokens will not be cleared after a password change

DIRAC: Unauthorized users can read proxy contents during generation

Contao: Possible cookie sharing with external domains while checking protected pages for broken links

Ollama DNS rebinding vulnerability

Ryu Infinite Loop vulnerability

Android Pixel Privilege Escalation Vulnerability

Grafana: Users outside an organization can delete a snapshot with its key

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this vulnerability may lead to a server-side denial of service.

Mattermost fails to authenticate the source of certain types of post actions

SheetJS Regular Expression Denial of Service (ReDoS)

dectalk-tts Uses Unencrypted HTTP Request

amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames

AMPHP Denial of Service via HTTP/2 CONTINUATION Frames

Voilà Local file inclusion

Dolibarr ERP CRM Code Injection vulnerability during installation

Pillow buffer overflow vulnerability

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

UVDesk Community Helpdesk Improper Privilege Management

Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability

Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability

Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability

Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability

Centreon updateGroups SQL Injection Remote Code Execution Vulnerability

Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability

In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists

Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

CodeIgniter4 DoS Vulnerability

@workos-inc/authkit-nextjs session replay vulnerability

@electron/packager's build process memory potentially leaked into final executable

Winter CMS Server-Side Template Injection (SSTI) vulnerability

Cilium has insecure IPsec transport encryption