Advisory Catalog

xmldom allows multiple root nodes in a DOM

easyii CMS's File Upload Management vulnerable to unrestricted upload

thlorenz browserify-shim vulnerable to prototype pollution

phpMyFAQ contains Weak Password Requirements

thlorenz browserify-shim vulnerable to prototype pollution

acryl-datahub missing JWT signature check

RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

Rdiffweb subject to Business Logic Errors

Prototype pollution in Snowboard framework

feathers-sequelize contains improper input validation leading to SQL injection

Insufficient validation when decoding a Socket.IO packet

Feather-Sequelize cleanQuery method vulnerable to Prototype Pollution

feathers-sequelize vulnerable to SQL injection due to improper parameter filtering

Badaso vulnerable to Remote Code Execution via malicious file upload

Improper Control of Generation of Code ('Code Injection') in Azure CLI

Buffer overflow in sponge queue functions

Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control

Rdiffweb is missing authentication for critical function

D-Link DSL-2750B Devices Command Injection Vulnerability

Oracle E-Business Suite Unspecified Vulnerability

Field-level access-control bypass for multiselect field

Fortinet Multiple Products Authentication Bypass Vulnerability

Missing rate limit on rdiffweb

Grunt-karma vulnerable to prototype pollution

Missing rate limit on rdiffweb

Origin Validation Error in rdiffweb

Prototype pollution in webpack loader-utils

Dolibarr vulnerable to Eval Injection

mockery is vulnerable to prototype pollution

tschaub gh-pages vulnerable to prototype pollution

thlorenz browserify-shim vulnerable to prototype pollution

The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.

The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.

The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.

The d8s-domains package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.

The d8s-html package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.

The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.

The d8s-pdfs package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-urls package. The affected version is 0.1.0.

The d8s-urls package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.

The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-csv package. The affected version is 0.1.0.

The d8s-lists package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0.

The d8s-algorithms package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-dicts package. The affected version is 0.1.0.

The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected version is 0.1.0.

The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected version is 0.1.0.

The d8s-xml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-html package. The affected version is 0.1.0.

The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-html package. The affected version is 0.1.0.

melisplatform/melis-cms vulnerable to deserialization of untrusted data

melisplatform/melis-front vulnerable to deserialization of untrusted data

Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom