Advisory Catalog

FastChat open redirect vulnerability

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially

Drupal Core Cross-Site Scripting (XSS) Vulnerability

Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes

Drupal RapiDoc OAS Field Formatter Cross-Site Scripting (XSS) vulnerability

Drupal Link field display mode formatter Cross-Site Scripting (XSS) vulnerability

Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout

vLLM denial of service via outlines unbounded cache on disk

Fast-JWT Improperly Validates iss Claims

Apache Airflow MySQL Provider is Vulnerable to SQL Injection

Clickstorm SEO Allows Cross-Site Scripting (XSS)

Additional TCA Allows Cross-Site Scripting (XSS)

Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads

TastyIgniter Has an Incorrect Access Control Vulnerability

Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Sylius PayPal Plugin Payment Amount Manipulation Vulnerability

A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to he

JS Html Sanitizer allows XSS when used with contentEditable

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`

nest allows a remote attacker to execute arbitrary code via the Content-Type header

MODX allows cross-site scripting (XSS) via an SVG file

laravel-crud-wizard-free has File Validation Bypass

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

XPixelGroup BasicSR Command Injection

Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability

Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler

Froxlor has an HTML Injection Vulnerability

Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups

Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability

Azure PromptFlow remote code execution related to Jinja templates

Microsoft Windows NTFS Information Disclosure Vulnerability

Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Concrete CMS affected by a stored XSS in Folder Function.The "Add Folder" functionality

PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImporter::ConvertToUTF8 of the file BaseImporter.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attac

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remo

Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch

Zip Exploit Crashes Picklescan But Not PyTorch

Laravel framework susceptible to reflected cross-site scripting

Laravel framework susceptible to reflected cross-site scripting

GeSHi XSS possible in the get_var function of /contrib/cssgen.php

NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

ray vulnerable to Insertion of Sensitive Information into Log File

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

Laravel has a File Validation Bypass

Drupal AI Vulnerable to OS Command Injection

REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation