Advisory Catalog

ezplatform-graphql GraphQL queries can expose password hashes

MessagePack for Golang subject to DoS via Unmarshal panic

Redwood is vulnerable to account takeover via dbAuth "forgot-password"

Microsoft Windows Scripting Languages Remote Code Execution Vulnerability

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Istio may allow identity impersonation if user has localhost access

snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)

cleo is vulnerable to Regular Expression Denial of Service (ReDoS)

pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)

fastify/websocket vulnerable to uncaught exception via crash on malformed packet

Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack

Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp

Google Chromium V8 Type Confusion Vulnerability

Apple iOS and iPadOS Out-of-Bounds Write Vulnerability

IBAX go-ibax vulnerable to SQL injection

IBAX go-ibax vulnerable to SQL injection

IBAX go-ibax vulnerable to SQL injection

IBAX go-ibax vulnerable to SQL injection

IBAX go-ibax vulnerable to SQL injection

phpCAS vulnerable to Service Hostname Discovery Exploitation

muhammara and hummus vulnerable to denial of service by NULL pointer dereference

muhammara and hummus vulnerable to null pointer dereference on bad response object

kangax html-minifier REDoS vulnerability

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<wabt::Type>>::size() at /bits/stl_vector.h.

Keylime: unhandled exceptions could lead to invalid attestation states

Ansible leaks password to logs

Execution with Unnecessary Privileges in JupyterApp

Apache IoTDB subject to ReDOS with Java 8

Inefficient Regular Expression Complexity in shescape

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Magento Improper input validation vulnerability

Markdownify subject to Remote Code Execution via malicious markdown file

phpMyFAQ vulnerable to Cross-site Scripting

Bifrost vulnerable to authentication check flaw that leads to authentication bypass

Lavalite vulnerable to Arbitrary File Read via Directory Traversal

Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd

parse-server crashes when receiving file download request with invalid byte range

MobSF allows attackers to read arbitrary files via a crafted HTTP request

minimatch ReDoS vulnerability

Withdrawn Advisory: ReDoS in py library when used with subversion

Django denial-of-service vulnerability in internationalized URLs

Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)

loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

Remote denial of service in Hyperledger Fabric Gateway

October CMS Safe Mode bypass leads to authenticated Remote Code Execution

Powerline Gitstatus vulnerable to arbitrary code execution

Signature bypass via multiple root elements

Signature bypass via multiple root elements