Advisory Catalog

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking

docarray prototype pollution

FunAudioLLM InspireMusic deserialization vulnerability

Marked allows Regular Expression Denial of Service (ReDoS) attacks

Drupal Quick Node Block Missing Authorization vulnerability

Drupal Quick Node Block Missing Authorization vulnerability

The Backup Plus extension for TYPO3 (ns_backup) allows XSS

The Backup Plus extension for TYPO3 (ns_backup) allows command injections

[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability

The femanager TYPO3 extension allows Insecure Direct Object Reference

TYPO3 Allows Unrestricted File Upload in File Abstraction Layer

TYPO3 Allows Information Disclosure via DBAL Restriction Handling

TYPO3 CMS Webhooks Server Side Request Forgery

Symfony UX allows unsanitized HTML attribute injection via ComponentAttributes

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype poll

Flask-AppBuilder open redirect vulnerability using HTTP host injection

lockfile-lint-api Vulnerable to Incorrect Behavior Order

Meteor Affected By Inefficient Regular Expression Complexity

tarteaucitron-wp WordPress Plugin Vulnerable to Stored Cross-Site Scripting

Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent the same TFA token within a 30 second window. This vulnerability is mitigated by the fact that an attacker must obtain a valid username/p

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent TFA from being bypassed when using the REST login routes. A new requirements check has been added to the status report so other authentic

This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent one time login links from bypassing TFA. This vulnerability is mitigated by the fact that an attacker must have access to an email accoun

This module enables you to add the Piwik Pro web statistics tracking system to your website. The module does not check the JS code that is loaded on the website. So a user with the "Administer Piwik Pro" permission could configure the module to load JS from a malicious website. This vulnerability

Sulu vulnerable to XXE in SVG File upload Inspector

Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data

Kirby vulnerable to path traversal of collection names during file system lookup

Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

Apache Superset Allows Ownership Takeover

@lumieducation/h5p-server Fails to Sanitize Plain Text Strings

TeleMessage TM SGNL Hidden Functionality Vulnerability

Django has a denial-of-service possibility in strip_tags()

Craft CMS stores arbitrary content provided by unauthenticated users in session files

Koillection Cross Site Scripting vulnerability

The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't sufficiently protect certain sensitive routes, allowing an attacker to view or modify various TFA-related settings.

The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't sufficiently check whether the TOTP token is already used or not for authenticator-based second-factor methods. This vulnerability is mitigated by the fact that an attacker must h

This module enables you to add a filter to text formats (Full HTML, Filtered HTML), which will remove every iframe where the "src" is not on the allowlist. The module doesn't sufficiently filter these iframes in certain situations. This vulnerability is mitigated by the fact that an attacker must

Klaro Cookie & Consent Management module is used for consent management for cookies and external sources. It makes changes to the markup to enable or disable loading. The module doesn't sufficiently sanitize data attributes allowing persistent Cross Site Scripting (XSS) attacks. This vulnerability

The COOKIES module protects users from executing JavaScript code provided by third parties, e.g., to display ads or track user data without consent. The cookies\_asset\_injector module (a sub-module of the COOKiES module) also allows inline JavaScript to be included in consent management. However,

This module extends the core Media module and allows site creators to permit oEmbed providers in addition to YouTube and Vimeo, which are deemed trustworthy by the Drupal Security Team. The module doesn't sufficiently mark its administrative permission as restricted, creating the possibility for th

@misskey-dev/summaly allows IP Filter Bypass via Redirect

league/commonmark contains a XSS vulnerability in Attributes extension

Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

Open WebUI allows limited stored XSS vila uploaded html file

Mezzanine CMS Cross-Site Scripting (XSS) vulnerability

Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields

Grokability Snipe-IT has incorrect authorization for accessing asset information

Information Disclosure via Flags override link

@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

@cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint