Advisory Catalog

SatyaLab opendiamond 10.1.1 vulnerable to path traversal because Flask send_file function used unsafely

Ganga allows absolute path traversal

rpc.py vulnerable to Deserialization of Untrusted Data

SQL injection in typeORM

Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

Command injection in git-clone

Prototype Pollution in deep.assign

Deserialization of Untrusted Data in topthink/framework

Server-Side Request Forgery in parse-url

JWS and JWT signature validation vulnerability with special characters

** Reserved ** The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.

The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

Prototype Pollution in deep-get-set

Path traversal in Concrete CMS

Code injection in concrete CMS

Unsafe yaml deserialization in NVFlare

Unsafe deserialisation in the PKI implementation scheme of NVFlare

Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled

SQL Injection in RosarioSIS

Code Injection in SEOmatic

OS Command Injection in git-promise

Directory traversal in convert-svg-core

Couchbase Sync Gateway admin credentials not verified when using X.509 client cert authentication

Server-Side Request Forgery in kityminder

Backdoor in api-res-py

The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.

Code Injection in metacalc

OS Command Injection in cookiecutter

Path Traversal in django-s3file

Unsanitized JavaScript code injection possible in gatsby-plugin-mdx

Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

Login timing attack in ibexa/core

Login timing attack in ezsystems/ezpublish-kernel

Login timing attack in ezsystems/ezplatform-kernel

Embedded Malicious Code in ctx

Command injection in librenms

OS Command Injection in s3-uploader

OS Command Injection in proctree

OS Command injection in ssl-utils

Command injection in docker-tester

Server-Side Template Injection in formio

Denial of service in bottle

Malware in ctx

Cross-site Scripting vulnerability in Mautic's tracking pixel functionality