Advisory Catalog

Moodle Code Injection vulnerability

AsyncSSH Rogue Session Attack

esptool allows attackers to view sensitive information via weak cryptographic algorithm

chromedriver Command Injection vulnerability

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.

PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block

ZITADEL race condition in lockout policy execution

Calico Typha denial of service vulnerability

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ aff

Unauthorized Access to Private Fields in User Registration API

Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation

Subrion remote command execution vulnerability

Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

Django Denial-of-service in django.utils.text.Truncator

Pillow Denial of Service vulnerability

FoodCoopShop Server-Side Request Forgery vulnerability

Django potential denial of service vulnerability in UsernameField on Windows

Dolibarr Improper Input Validation vulnerability

Kubernetes privilege escalation vulnerability

Kubernetes privilege escalation vulnerability

xkeys seal encryption used fixed key for all encryption

generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character

phpMyFAQ Cross-site Scripting vulnerability

Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

quic-go vulnerable to pointer dereference that can lead to panic

pimcore/admin-ui-classic-bundle Unverified Password Change

Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

juzawebCMS Injection vulnerability

Cosmos packet-forward-middleware vulnerable to chain-halt

F5 BIG-IP Configuration Utility SQL Injection Vulnerability

browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack

Ingress nginx annotation injection causes arbitrary command execution

Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Ingress-nginx path sanitization can be bypassed

gRPC-Go HTTP/2 Rapid Reset vulnerability

Inefficient Regular Expression Complexity in node-email-check

Cisco IOS XE Web UI Command Injection Vulnerability

Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

Nautobot vulnerable to exposure of hashed user passwords via REST API

Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload

encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs

Parse Server may crash when uploading file without extension

free5GC udm vulnerable to Invalid Curve Attack

Next.js missing cache-control header may lead to CDN caching empty reply

Langchain Server-Side Request Forgery vulnerability

PDM Trojan Lockfile

modoboa Cross-site Scripting vulnerability

modoboa Cross-Site Request Forgery vulnerability

Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables