Advisory Catalog

Cross-site Scripting in Bagisto

readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects

Default swagger-ui configuration exposes all files in the module

Minor fix to previous patch for CVE-2022-35918

MediaWiki Cargo Extension Cross-site Scripting vulnerability

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

The Typogrify module brings the typographic refinements of Typogrify to Drupal. It provides a text filter and a Twig filter. The typogrify Twig filter can be used to bypass the Twig auto-escape feature, leading to a persistent Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigat

WWBN AVideo recovery notification bypass vulnerability

CRI-O's pods can break out of resource confinement on cgroupv2

Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts

Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list

Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

quic-go's path validation mechanism can be exploited to cause denial of service

react-native-mmkv Insertion of Sensitive Information into Log File vulnerability

Parsing JSON serialized payload without protected field can lead to segfault

Apprite CLI makes Use of Hard-coded Credentials

juzawebCMS Incorrect Access Control vulnerability

Puma HTTP Request/Response Smuggling vulnerability

pyload Log Injection vulnerability

Flarum's logout Route allows open redirects

Kruise allows leveraging the kruise-daemon pod to list all secrets in the entire cluster

Firefly III allows webhooks HTML Injection.

view_component Cross-site Scripting vulnerability

class.upload.php allows cross-site scripting attacks via uploaded files

CubeFS leaks users key in logs

CubeFS leaks magic secret key when starting Blobstore access service

PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)

Gila CMS SQL Injection

Mattermost viewing archived public channels permissions vulnerability

Mattermost notified all users in the channel when using WebSockets to respond individually

Follow Redirects improperly handles URLs in the url.parse() function

Layui cross-site scripting (XSS) vulnerability

Hail relies on OIDC email claims to verify the validity of a user's domain.

Arbitrary remote file read in Wrangler dev server

Winter CMS Local File Inclusion through Server Side Template Injection

Winter CMS Stored XSS through Backend ColorPicker FormWidget

Winter CMS Stored XSS through privileged upload of Media Manager file followed by renaming

ewen-lbh/ffcss Late-Unicode normalization vulnerability

ActiveAdmin CSV Injection leading to sensitive information disclosure

DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value

Open redirect vulnerability in Flask-Security-Too

Concrete CMS Cross Site Request Forgery (CSRF)

Path Traversal in TYPO3 File Abstraction Layer Storages

Nautobot missing object-level permissions enforcement when running Job Buttons

Potential URI resolution path traversal in the AWS SDK for PHP

Cross-Site Request Forgery (CSRF) in automad/automad

Withdrawn Advisory: Unrestricted File Upload affecting automad

Apache Airflow has a stored cross-site scripting vulnerability

Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere

Apache Airflow Cross-Site Request Forgery vulnerability