Advisory Catalog

dbt allows Binding to an Unrestricted IP Address via socketsocket

rockhopper Buffer Overflow vulnerability

PHP Server Monitor vulnerable to Cross-site Scripting

Pug allows JavaScript code execution if an application accepts untrusted input

vxe-table Cross-site Scripting vulnerability

silverstripe/framework ReadOnly transformation for formfields exploitable

Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

Silverstripe Missing CSRF protection in login form

Silverstripe XSS in CMS Edit Page

Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers

Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter

Silverstripe Missing security check on dev/build/defaults

Silverstripe HtmlEditor embed url sanitisation

Silverstripe Form field validation message XSS vulnerability

Silverstripe framework is vulnerable to XSS in install.php

SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

Silverstripe XSS in dev/build returnURL Parameter

Silverstripe External redirection risk in Security?ReturnURL

Silverstripe XSS in Director::force_redirect()

Silverstripe XSS In FormAction

Silverstripe XSS In rewritten hash links

Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop

Silverstripe XSS In GridField print

Silverstripe XSS in TreeDropdownField and TreeMultiSelectField

SilverStripe framework XML Quadratic Blowup Attack

Silverstripe IE requests not properly behaving with rewritehashlinks

Silverstripe Forum Module CSRF Vulnerability

jupyter-scheduler's endpoint is missing authentication

Silverstripe XSS vulnerability via VirtualPage

Dapr API Token Exposure

Silverstripe History XSS Vulnerability

The Commerce View Receipts module enables you to view commerce order receipts in the browser. The module doesn't sufficiently check access permissions, allowing an unauthorised user to view the private information of other customers.

Shopware Non-Persistent XSS in the Frontend

sensiolabs/connect has a Cross-Site Request Forgery Vulnerability

OMERO.web must check that the JSONP callback is a valid function

github.com/cosmos/ibc-go affected by IBC protocol "Huckleberry" vulnerability

Stacklok Minder vulnerable to denial of service from maliciously crafted templates

Trivy possibly leaks registry credential when scanning images from malicious registries

verbb/formie Server-Side Template Injection for variable-enabled settings

Requests `Session` object does not verify requests after making first request with verify=False

Pusher Service Channel Authentication Bypass

phpxmlrpc/extra XSS in class documenting_xmlrpc_server

Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

Passbolt Api E-mail HTML injection

OroPlatform Forced Redirect to External Website

OroCRM Forced Redirect to External Website

aiosmtpd STARTTLS unencrypted commands injection

onelogin/php-saml signature wrapping attacks

Privilege Escalation in TYPO3 Neos

Time-Based Information Disclosure Vulnerability in Flow