Advisory Catalog

baserCMS OS command injection vulnerability in Installer

Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability

Kirby vulnerable to unrestricted file upload of user avatar images

Withdrawn Advisory: Kirby CMS HTML injection vulnerability

cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

ConnectWise ScreenConnect Path Traversal Vulnerability

MantisBT Host Header Injection vulnerability

MeshCentral cross-site websocket hijacking (CSWSH) vulnerability

Cross-site Scripting in electron-pdf

Cross-site Scripting in Pyhtml2pdf

Potential buffer overflow in CBOR2 decoder

Cross-Site Request Forgery in moodle

Uncontrolled Resource Consumption in moodle

Code injection in REDAXO

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`

Scrapy decompression bomb vulnerability

React Native Document Picker Directory Traversal vulnerability

Scrapy authorization header leakage on cross-domain redirect

Scrapy vulnerable to ReDoS via XMLFeedSpider

TYPO3 Install Tool vulnerable to Code Execution

XSS sidekiq-unique-jobs UI server vulnerability

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler

derhansen/sf_event_mgt vulnerable to Broken Access Control in Backend Module

mapshaper Path Traversal vulnerability

angular vulnerable to super-linear runtime due to backtracking

Pkg Local Privilege Escalation

October CMS Cross-site Scripting vulnerability

HashiCorp Nomad vulnerable to symlink attacks

Rancher API Server Cross-site Scripting Vulnerability

Norman API Cross-site Scripting Vulnerability

Rancher 'Audit Log' leaks sensitive information

Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'

Kinto Attachment's attachments can be replaced on read-only records

Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php

APM Server vulnerable to Insertion of Sensitive Information into Log File

The Migrate Tools module provides tools for running and managing Drupal migrations. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an attacker to trick an authenticated administrator into initiating a migration. This vulnerability is mi

Django denial-of-service attack in the intcomma template filter

Allegro AI ClearML path traversal vulnerability

Allegro AI ClearML vulnerable to deserialization of untrusted data

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

Boundary vulnerable to session hijacking through TLS certificate tampering

Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657

python-multipart vulnerable to Content-Type Header ReDoS

Yarn untrusted search path vulnerability

Talos Linux ships runc vulnerable to the escape to the host attack