Advisory Catalog

This module makes it possible for you to integrate Cookiebot and Google Tag Manager in a fast and simple way. The module doesn't sufficiently filter for malicious script leading to a persistent cross site scripting (XSS) vulnerability.

Express ressource injection

In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint,

MPXJ has a Potential Path Traversal Vulnerability

Funadmin Cross-site Scripting vulnerability

Werkzeug possible resource exhaustion when parsing file data in forms

Werkzeug safe_join not safe on Windows

The Snowflake Connector for Python stores sensitive data in logs

A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSanitizer. The crash occurred due to a read access to an invalid memory address (0x1000c9714971).

A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a n

A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files.

Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

ai-admin-graphql has a Denial of service vulnerability in SaaS and marketplace setups

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature

baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request

baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature

Cisco ASA and FTD Denial-of-Service Vulnerability

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. In certain cases the module doesn't sufficiently sanitize data before passing it to PHP's unserialize() function, which can result in arbitrary code execution.

This module enables you to animate an SVG graphic by selecting certain rows in a view. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload SVG files.

This module enables you to embed the content of an SVG file into the body html of a node and optionally allows to translate text contained within the image. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an

Flair allows arbitrary code execution

Path traversal in redaxo

Admidio Vulnerable to HTML Injection In The Messages Section

Drupal core vulnerable to improper error handling

Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Valid ECDSA signatures erroneously rejected in Elliptic

Cross site scripting in markdown-to-jsx

OpenCanary Executes Commands From Potentially Writable Config File

DOM Clobbering Gadget found in astro's client-side router that leads to XSS

Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint

Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files

Gradio performs a non-constant-time comparison when comparing hashes

Gradio has several components with post-process steps allow arbitrary file leaks

Gradio vulnerable to SSRF in the path parameter of /queue/join

Gradio has a one-level read path traversal in `/custom_component`

Gradio's CORS origin validation accepts the null origin

Gradio's `is_in_or_equal` function may be bypassed

Magento Open Source Improper Access Control vulnerability

Magento Open Source Information Exposure vulnerability

Magento Open Source Information Exposure vulnerability

Magento Open Source Improper Authorization vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source Improper Authorization vulnerability

Magento Open Source stored Cross-Site Scripting (XSS) vulnerability

Magento Open Source Incorrect Authorization vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability