Advisory Catalog

Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

moodle: IDOR when fetching report schedules

moodle: Some users can delete audiences of other reports

moodle: IDOR in edit/delete RSS feed

Moodle leaks user names

django CMS Cross-Site Scripting (XSS)

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

OpenStack improperly deletes access rules

LibreNMS has a stored XSS in ExamplePlugin with Device's Notes

MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability

CSRF leading to delete account in wallabag/wallabag

Improper Authorization in dolibarr/dolibarr

Cross-site Scripting (XSS) - DOM in janeczku/calibre-web

Improper Access Control in janeczku/calibre-web

Generation of Error Message Containing Sensitive Information in janeczku/calibre-web

Cross site scripting in sylius/sylius

An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other maliciou

ReDoS in giskard's transformation.py (GHSL-2024-324)

Missing ratelimit on passwrod resets in zenml

Salt preflight script could be attacker controlled

The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (public, private, etc). This module accepts any uploaded file extension, including dangerous file formats so it can be used to bypass the allow\_insecu

UnoPim Stored XSS : Cookie hijacking through Create User function

Moodle IDOR when accessing list of badge recipients

dom-iterator code execution vulnerability

Citrix Session Recording Deserialization of Untrusted Data Vulnerability

Citrix Session Recording Improper Privilege Management Vulnerability

Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability

matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

Ansible-Core vulnerable to content protections bypass

Orchid Platform has Method Exposure Vulnerability in Modals

Moodle reflected XSS via H5P error message

Moodle Cross-site Scripting vulnerability

Moodle has insufficient capability checks

Moodle's user/power level management inconsistent with suspended users

Moodle authorization headers preserved between "emulated redirects"

Moodle has insufficient access control

Moodle has user information visibility control issues in gradebook reports

Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data

Froala WYSIWYG editor allows cross-site scripting (XSS)

UnoPim Cross-site Scripting vulnerability

Gradio vulnerable to arbitrary file read with File and UploadButton components

This module enables you to add any HTML content you want in a tooltip displayed on mouse hover. The module does not sufficiently escape the markup inserted in the tooltip block. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".

Symfony vulnerable to open redirect via browser-sanitized URLs

Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient

ansible-core Incorrect Authorization vulnerability

OctoPrint has API key access in settings without reauthentication

OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

gradio Server Side Request Forgery vulnerability

changedetection.io Path Traversal

Integrates your Drupal website with the Oh Dear monitoring app. Cached data of monitoring results is accessible to non-logged in users when caching is enabled on the module. This vulnerability is mitigated by the fact that it only affects sites where caching is enabled for OhDear report healthchec