Advisory Catalog

Concrete CMS Cross Site Request Forgery (CSRF) vulnerability

Concrete CMS Stored XSS in Layout Preset Name

Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

This module gives each node a 'private' checkbox. If it's set, the node can only be seen by the node author, or users with the 'access private content' permission. The module incorrectly grants access to private nodes under certain specific circumstances. This vulnerability is mitigated by the fact

The Coffee module helps you to navigate through the Drupal admin menus faster with a shortcut popup. The module doesn't sufficiently escape menu names when displaying them in the popup, thereby exposing a XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a r

Apache Superset: Improper authorization validation on dashboards and charts import

Apache Superset: Improper data authorization when creating a new dataset

Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

Apache Superset: Improper Neutralization of custom SQL on embedded context

Apache Superset: Improper error handling on alerts

Webtrees Path Traversal vulnerability

Magento LTS vulnerable to stored XSS in admin file form

Rails has possible Sensitive Session Information Leak in Active Storage

Rails has possible XSS Vulnerability in Action Controller

Subrion CMS vulnerable to Cross Site Scripting

Minder trusts client-provided mapping from repo name to upstream ID

Vyper's `extract32` can ready dirty memory

Vyper's `_abi_decode` vulnerable to Memory Overflow

Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

Rack CORS Middleware has Insecure File Permissions

es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type

sanitize-html Information Exposure vulnerability

Gradio apps vulnerable to timing attacks to guess password

Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository

baserCMS Cross-site Scripting vulnerability in Content Management

baserCMS Cross-site Scripting vulnerability in Site search Feature

Enhavo Cross-site Scripting vulnerability

Enhavo Cross-site Scripting vulnerability

Enhavo Cross-site Scripting vulnerability

Apache Answer Cross-site Scripting vulnerability

Apache Answer Race Condition vulnerability

Path Traversal in TYPO3 Core

Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field

This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled.

ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool`

ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module

Unencrypted traffic between pods when using Wireguard and an external kvstore

Unencrypted ingress/health traffic when using Wireguard transparent encryption

Cross-site scripting (XSS) in the dynamic file uploads

Possibility to circumvent the invitation token expiry period

Possible CSRF attack at questionnaire templates preview

Path disclosure in JavaScript variable

Authorization Bypass in moodle

Improper Access Control in moodle

Improper Access Control in moodle

Improper Handling of Parameters in moodle