Advisory Catalog

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

Improperly Controlled Modification of Object Prototype Attributes

Remote Code Execution via Script (Python) objects under Python 3

Panic on inputs with large exponents in math/big

Panic when reading certain archives in archive/zip

Improper sanitization when resolving values from DNS in net

URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal

Remote Code Execution via unsafe classes in otherwise permitted modules

Arbitrary Code Execution in Rdoc

Trend Micro Multiple Products Improper Input Validation Vulnerability

Trend Micro Multiple Products Improper Input Validation Vulnerability

An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.

No Restriction of Excessive Authentication Attempts in Firefly III

ExternalName Services can be used to gain access to Envoy's admin interface

Privilege escalation: all users can access Admin-level API keys

Microsoft Windows SAM Local Privilege Escalation Vulnerability

Directory Traversal in Archive_Tar

github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion

netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).

HashiCorp Consul L7 deny intention results in an allow action

Hashicorp Consul Missing SSL Certificate Validation

Basic-auth app bundle credential exposure in gatsby-source-wordpress

Rancher Privilege escalation vulnerability via malicious "Connection" header

Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft Exchange Server Information Disclosure

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft Exchange Server Information Disclosure Vulnerability

Improper Input Validation in is-email

Files or Directories Accessible to External Parties in ether/logs

SQL injection in pimcore/pimcore

Arbitrary file upload in Fork CMS

Linux Kernel Heap Out-of-Bounds Write Vulnerability

Regular Expression Denial of Service in Addressable templates

Integer overflow in pywin32

Microsoft Windows Print Spooler Remote Code Execution Vulnerability

Google Chromium WebGL Use-After-Free Vulnerability

Cross-site scripting (XSS) from field and configuration text displayed in the Panel

EC-CUBE Improper access control vulnerability

libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.

Prototype Pollution in think-helper

XML2Dict XML Entity Expansion Vulnerability

Header injection in nodemailer

Regular Expression Denial of Service (ReDoS) in Prism

Magento Path Traversal vulnerability

Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats

Reflected XSS from the callback handler's error query parameter

Exposure of Sensitive Information to an Unauthorized Actor

Possible bypass of token claim validation when OAuth2 Introspection caching is enabled

ReDOS in Mpmath