Advisory Catalog

Denial-of-Service when binding invalid parameters in sqlite3

Multiple valid tokens for password reset in Shopware

Malfunction of CSRF token validation in Shopware

Apache Doris hardcoded key and IV

Insufficient type validation in pocketmine/pocketmine-mp

http-swagger XSS via PUT requests

SQL Injection found in Pimcore

SQL injection in blazer

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

Improper Access Control in Shopware

Server-Side Request Forgery (SSRF) in Shopware

Improper input validation in Drupal core

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

Insecure plugin handling in Mattermost

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

Prototype Pollution in madlib-object-utils

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Microsoft Windows CLFS Driver Privilege Escalation Vulnerability

Improper Authentication in django-mfa3

MantisBT CSV Injection unprivileged user access in csv_export.php

Missing input validation can lead to command execution in composer

VMware Multiple Products Privilege Escalation Vulnerability

SQL Injection in Pimcore

Express-FileUpload Arbitrary File Overwrite

Prototype Pollution in nconf

Denial of Service (DoS) in Nokogiri on JRuby

Out-of-bounds Write in zlib affects Nokogiri

Nokogiri Inefficient Regular Expression Complexity

Persistent Cross-site Scripting vulnerability in PrivateBin

Code Injection in Bolt CMS

Daemon panics when processing certain blocks

Duplicate Advisory: go-codec-dagpb vulnerable to panic when decoding invalid blocks

Improper Neutralization of Formula Elements in a CSV File in Kimai 2

SQL Injection in Pimcore

SQL Injection when creating an application with Reactive SQL backend

Denial of Service vulnerability in @podium/layout and @podium/proxy

Prototype Pollution in async

Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown

Cross-site Scripting in TastyIgniter

Privilege escalation in beego

Privilege escalation in beego

SQL injection in ImpressCMS

Incorrect protocol extraction via \r, \n and \t characters

Weak password hash in LiveHelperChat

Server side request forgery in LiveHelperChat

Files or Directories Accessible to External Parties in Adminer

Google Chromium Animation Use-After-Free Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus

Remote code execution in Subrion