Advisory Catalog

Blink1Control2 uses weak password encryption

MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)

mako is vulnerable to Regular Expression Denial of Service

x/crypto/ssh vulnerable to panic via malformed packets

golang.org/x/net/http2 Denial of Service vulnerability

Barbican authorization flaw before v14.0.0

The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequently, an attacker can execute arbitrary C++ code. NOTE: the vendor's position is "GSQL was behaving as expected."

Apache IoTDB Session Fixation vulnerability

Indy's NODE_UPGRADE transaction vulnerable to remote code execution

Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing

Binary vulnerable to Slice Memory Allocation with Excessive Size Value

NodeBB account takeover via SSO plugins

elrond-go MultiESDTNFTTransfer call on a SC address with missing function name

Flux CLI Workload Injection

Denial of service due to incorrect application of event authorization rules

Broken Authorization in ZITADEL Actions

Cross-site scripting from content entered in the tags and multiselect fields

Sanitize-html Vulnerable To REDoS Attacks

yaml package for Go can consume excessive amounts of CPU or memory

oauth2-server through 3.1.1 vulnerable to Open Redirect

Improper Control of Generation of Code ('Code Injection') in mdx-mermaid

Polynomial regular expression used on uncontrolled data in nitrado.js

ZK Framework AuUploader Unspecified Vulnerability

Insufficient Session Expiration in snipe/snipe-it

VTK NULL pointer dereference vulnerability

Incorrect header handling in mod-wsgi

Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

Improper token validation leading to code execution in Teleport

Apple iOS and macOS Out-of-Bounds Write Vulnerability

Apple iOS and macOS Out-of-Bounds Write Vulnerability

uri-template-lite Regular Expression Denial of Service

ansible-runner vulnerable to shell command injection

exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability

node-opcua DoS when bypassing limitations for excessive memory consumption

Uncontrolled Resource Consumption in asyncua and opcua

node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit

Uncontrolled Resource Consumption in node-opcua

Regular expression denial of service in eth-account

Unverified Password Change in OctoPrint

Exposure of password hashes in notrinos/notrinos-erp

PocketMine-MP invalid skin geometry JSON data leading to server crash

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Ethermint vulnerable to DoS through unintended Contract Selfdestruct

Duplicate Advisory: KubeVirt arbitrary host file read from the VM

Bots using py-cord as Discord API wrapper are vulnerable to shutdowns through remote code execution

HashiCorp Consul Template could reveal Vault secret contents in error messages

Magento Improper Access Control vulnerability

Magento Path Traversal vulnerability

Moodle Incorrect Authorization vulnerability

Remote code execution in Apache Airflow Docker's Provider