Advisory Catalog

phpMyFAQ Cross-site Scripting vulnerability

Microweber uses hard coded credentials

Composer Remote Code Execution vulnerability via web-accessible composer.phar

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro

Rdiffweb Allocation of Resources Without Limits or Throttling vulnerability

pretix allows Pillow to parse EPS files

Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

Zod denial of service vulnerability

Electron affected by libvpx's heap buffer overflow in vp8 encoding

Economizzer host header injection vulnerability

Economizzer remote code execution vulnerability

@napi-rs/image affected by libwebp CVE

Chaijs/get-func-name vulnerable to ReDoS

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

OpenCart Path Traversal vulnerability

Vyper's `_abi_decode` input not validated in complex expressions

yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`

kube-apiserver authentication bypass vulnerability

OpenStack Heat information leak vulnerability

Markdown vulnerable to Out-of-bounds Read while parsing citations

pgAdmin failed to properly control the server code

FUXA local file inclusion vulnerability

FUXA SQL Injection vulnerability

FUXA vulnerable to Local File Inclusion

Withdrawn Advisory: Mobile Security Framework (MobSF) Vulnerable to Insecure Permissions

Apple Multiple Products WebKit Code Execution Vulnerability

Apple Multiple Products Kernel Privilege Escalation Vulnerability

plone.rest vulnerable to Denial of Service when ++api++ is used many times

Composer allows cache poisoning from other projects built on the same host

Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

Croc sender may send dangerous new files to receiver

Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device

File Upload vulnerability in Dolibarr ERP CRM

Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script

Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability

Cross site scripting in librenms

Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

Cross-Site Request Forgery (CSRF) in usememos/memos

GeoNode vulnerable to SSRF Bypass to return internal host data

Directus affected by VM2 sandbox escape vulnerability

PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)

PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey

Apache HDFS Provider error message suggested

Adobe ColdFusion Improper Access Control Vulnerability

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

Microsoft Streaming Service Proxy Privilege Escalation Vulnerability

Cecil Path Traversal vulnerability

libwebp: OOB write in BuildHuffmanTable

Apache Airflow information exposure vulnerability