Advisory Catalog

ScienceLogic SL1 Unspecified Vulnerability

Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

angular-base64-upload vulnerable to unauthenticated remote code execution

JSONPath Plus Remote Code Execution (RCE) Vulnerability

Elliptic's verify function omits uniqueness validation

Palo Alto Networks Expedition SQL Injection Vulnerability

Palo Alto Networks Expedition OS Command Injection Vulnerability

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. A function which can be used by third-party code does not return valid data under certain rare circumstances. If the third-party code relies on this data to decide whether to grant ac

Mozilla Firefox Use-After-Free Vulnerability

Microsoft Configuration Manager SQL Injection Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

This module enables users to remain logged in separately from session timeouts. The module doesn't sufficiently check a user's disabled status when validating cookies. This vulnerability is mitigated by the fact that an attacker must have an unexpired cookie from a previous successful login.

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module does not sufficiently migrate sessions before prompting for a second factor token. This vulnerability is mitigated by the fact that an attacker must fixate

This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also allows pretty viewing of all added/changed/deleted words between revisions. The module doesn't sufficiently check revision access before rendering a diff report for 1) nodes or 2

Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability

LangChain Experimental Eval Injection vulnerability

sqlitedict insecure deserialization vulnerability

PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability

VMware vCenter Server Privilege Escalation Vulnerability

VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

AutoGPT bypass of the shell commands denylist settings

D-Tale vulnerable to Remote Code Execution through the Query input on Chart Builder

ThinkPHP deserialization vulnerability

pyload-ng vulnerable to RCE with js2py sandbox escape

Veeam Backup and Replication Deserialization Vulnerability

H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

Cisco Smart Licensing Utility Static Credential Vulnerability

@blakeembrey/template vulnerable to code injection when attacker controls template input

Progress WhatsUp Gold SQL Injection Vulnerability

Powermail TYPO3 extension Broken Access Control in the OutputController

SonicWall SonicOS Improper Access Control Vulnerability

LlamaIndex includes an exec call for `import {cls_name}`

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

Google Chromium V8 Type Confusion Vulnerability

squirrelly Code Injection vulnerability

Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files

Kingsoft WPS Office Path Traversal Vulnerability

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Prototype pollution in izatop bunt

Shopware vulnerable to blind SQL-injection in DAL aggregations

Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

The Opigno module is related to Opigno LMS distribution. It implements the module entity, that is a sub-part of a training. In the opigno\_module module, uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Si

Django SQL injection vulnerability

Nuxt vulnerable to remote code execution via the browser when running the test locally

RoundCube Webmail Cross-Site Scripting Vulnerability