Advisory Catalog

Cross-site Scripting in Serenity

Open Redirect in github.com/greenpau/caddy-security

Server-Side Request Forgery in github.com/greenpau/caddy-security

Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security

Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security

Insufficient Session Expiration in github.com/greenpau/caddy-security

Improper Validation of Array Index in github.com/greenpau/caddy-security

Authentication Bypass by Spoofing in github.com/greenpau/caddy-security

Use of Insufficiently Random Values in github.com/greenpau/caddy-security

Cross-site Scripting in github.com/greenpau/caddy-security

Undici proxy-authorization header not cleared on cross-origin redirect in fetch

fetch(url) leads to a memory leak in undici

YetiForceCRM Directory Traversal vulnerability

Helm dependency management path traversal

Magento Open Source allows Cross-Site Request Forgery (CSRF)

Magento Open Source allows Uncontrolled Resource Consumption

The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a [security update](https://ckeditor.com/cke4/release/CKEditor-4.24.0-LTS) that on certain configurations may impact the Drupal module that bundles and integrates this code. The vuln

Duplicate Advisory: Apache Superset uncontrolled resource consumption

registry-support: decompress can delete files outside scope via relative paths

Email Validation Bypass And Preventing Sign Up From Email's Owner

TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme

TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key

TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords

caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting

Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder

Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder

Drupal core Denial of Service vulnerability

lambda-middleware Inefficient Regular Expression Complexity vulnerability

Moodle Improper Access Control vulnerability

Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature

Concrete CMS vulnerable to stored XSS in file tags and description attributes

Concrete CMS vulnerable to stored XSS via the Role Name field

Mattermost vulnerable to denial of service via large number of emoji reactions

Mattermost Jira Plugin does not properly check security levels

NoneBot Potential Information Leak in User-Constructed Message Templates

Cross-site scripting (XSS) vulnerability in Grav

CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature

CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection

Ansible-core information disclosure flaw

pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

Sulu HTML Injection via Autocomplete Suggestion

Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062

phpMyFAQ vulnerable to stored XSS on attachments filename

phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes

phpMyFAQ User Removal Page Allows Spoofing Of User Details

Vyper sha3 codegen bug

Stimulsoft Dashboard.JS Cross Site Scripting vulnerability

Stimulsoft Dashboard.JS Cross Site Scripting vulnerability

Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images

Etcd Gateway TLS endpoint validation only confirms TCP reachability