Advisory Catalog

destiny.gg chat vulnerable to cross-site request forgery

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

jsonwebtoken unrestricted key type could lead to legacy keys usage

rdiffweb vulnerable to Cross-Site Request Forgery

dustjs-linkedin vulnerable to Prototype Pollution

kyverno verifyImages rule bypass possible with malicious proxy/registry

OpenStack Kolla sudo privilege escalation vulnerability

lite-dev-server vulnerable to Directory Traversal

OpenFGA Authorization Bypass

lite-server vulnerable to Denial of Service

easy-static-server vulnerable to Directory Traversal

SilverStripe Subsite weakens file permissions

Knex.js has a limited SQL injection vulnerability

active_attr Improper Resource Shutdown or Release vulnerability

UBI Reader vulnerable to Path Traversal

Apple iOS Type Confusion Vulnerability

"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data

"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data

A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparser_find_proxy of the file src/pacparser.c. The manipulation of the argument url leads to buffer overflow. Attacking locally is a requirement. Upgrading to version 1.4.0

Inefficient Regular Expression Complexity in rails-html-sanitizer

Uncontrolled Recursion in Loofah

Inefficient Regular Expression Complexity in Loofah

TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework

TYPO3 CMS vulnerable to Denial of Service in Page Error Handling

pgadmin4 vulnerable to Code Injection

Authentication Bypass for passport-wsfed-saml2

AList vulnerable to Improper Preservation of Permissions

Amazon CloudWatch Agent for Windows has Privilege Escalation Vector

phpMyFAQ has insecure HTTP cookies

@cubejs-backend/api-gateway row level security bypass

Akeneo PIM Community Edition vulnerable to remote php code execution

go-merkledag's ProtoNode may be modified such that common method calls may panic

Unchecked return value from xmlTextReaderExpand

libp2p DoS vulnerability from lack of resource management

Certifi removing TrustCor root certificate

libp2p DoS vulnerability from lack of resource management

Casdoor arbitrary file deletion vulnerability via uploadFile function

Passeo uses insecure random number generator

Thinkphp has a code logic error

Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

Prometheus vulnerable to basic authentication bypass

Craft CMS discloses password hashes

nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit

GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package

Google Chromium V8 Type Confusion Vulnerability

ThinkCMF Cross Site Request Forgery (CSRF) vulnerability

Sinatra vulnerable to Reflected File Download attack

snyk Code Injection vulnerability

static-dev-server vulnerable to path traversal

D-Link DNR-322L Download of Code Without Integrity Check Vulnerability