Advisory Catalog

Magento Open Source Improper Access Control vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

Magento Open Source Server-Side Request Forgery (SSRF) vulnerability

open-webui allows writing and deleting arbitrary files

open-webui Insecure Direct Object Reference (IDOR) vulnerability

Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with stack traces can result in a runtime crash in certain WebAssembly modules. The runtime crash may be undefined behavior if Wasmtime was compiled with Rust 1.80 or prior. The runtime c

This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently filter for malicious script leading to a reflected cross site scripting (XSS) vulnerability. The vulnerability exists in the Facets Summary submodule. If you do not use that sub module

Denial of Service in TYPO3 Bookmark Toolbar

Directus inserts access token from query string into logs

Django allows enumeration of user e-mail addresses

Information Disclosure in TYPO3 Page Tree

ggit is vulnerable to Arbitrary Argument Injection via the clone() API

SAP HANA Node.js client package vulnerable to Prototype Pollution

Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name

LimeSurvey Cross Site Scripting vulnerability

LimeSurvey Cross Site Scripting vulnerability

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page

Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS

PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file

Mediawiki Cargo extension vulnerable to Cross-site Scripting

Improper permissions handling in MediaWiki AbuseFilter

cookie accepts cookie name, path, and domain with out of bounds characters

OpenStack Ironic fails to verify checksums of supplied image_source URLs

Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS

@saltcorn/server arbitrary file and directory listing when accessing build mobile app results

@saltcorn/server arbitrary file zip read and download when downloading auto backups

Express Open Redirect vulnerability

Sentry SDK Prototype Pollution gadget in JavaScript SDKs

Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

Cross-site Scripting via uploaded SVG

Injection of arbitrary HTML/JavaScript code through the media download URL

Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript

Zenario Cross Site Scripting in the Image library

October allows an admin account to upload PDF containing malicious JavaScript

Zenario allows authenticated admin users to upload PDF files containing malicious code

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Slim Select has potential Cross-site Scripting issue

Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP

LibreNMS vulnerable to Stored Cross-site Scripting via File Upload

LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature

LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature

LibreNMS has Stored Cross-site Scripting vulnerability in "Device Dependencies" feature

Pagekit Cross-site Scripting vulnerability

git-shallow-clone Argument Injection vulnerability

starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

MantisBT vulnerable to information disclosure with user profiles

Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting