Advisory Catalog

Httpful is Missing Certificate Validation

Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

AngularJS allows attackers to bypass common image source restrictions

AngularJS allows attackers to bypass common image source restrictions

HTML injection in JupyterLite leading to DOM Clobbering

Indico has a Cross-Site-Scripting during account creation

Drupal Open Social allows Functionality Misuse

Open Social is a Drupal distribution for online communities, which ships with an optional module called Social Embed. This module allows a website to display embedded content (such as photos or videos) when a user posts a link to that resource, without having to parse the resource directly. Added

Flask-AppBuilder's login form allows browser to cache sensitive fields

Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

This module enables field collections to be displayed as tables. It supports display suite and field permissions and provides operations (modify, delete, duplicate). This module has multiple vulnerabilities due to the requirements on the routes it provides not being restrictive enough. Information

This module enables you to "clone" a content entity, i.e. to create a new content pre-filled with data from another entity of the same type and bundle. The module doesn't properly check the user access to the original entity, allowing users to create a new entity (they have permission to create) pr

This module enables you to configure a wiki-like input filter that allows users to create links to site and external content. The module doesn't sufficiently check if a user has access to some URLs before rendering them as links. This vulnerability is mitigated by the fact that an attacker must ha

pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

DOM clobbering could escalate to Cross-site Scripting (XSS)

ReDoS in urlregex

Adyen APIs Library for Python timing attack vulnerability

Svelte has a potential mXSS vulnerability due to improper HTML escaping

FeehiCMS User[avatar] unrestricted upload

FeehiCMS BannerForm[img] unrestricted upload

FeehiCMS file upload vulnerability

Drupal Full Path Disclosure

"powermail" (powermail) Insecure Direct Object Reference (IDOR)

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

This module enables you to cache pages for logged in users at the Varnish level. The Varnish bin names may be guessable when no hashing noise configuration is set on the module configuration page, which would ultimately allow any user to view cached pages that were intended for other roles when gue

Taipy has a Session Cookie without Secure and HTTPOnly flags

AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template

Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS

FastAPI Admin Cross-site Scripting vulnerability in the Config-Create function

FastAPI Admin cross-site scripting (XSS) vulnerability in the Create Product function

Automad Cross-site Scripting vulnerability

Mage AI Path Traversal vulnerability

Mage AI Path Traversal vulnerability

Mage AI Path Traversal vulnerability

Hono CSRF middleware can be bypassed using crafted Content-Type header

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths. The module doesn't respect custom node access restrictions implemented through hook\_ENTITY\_TYPE\_access hooks meaning the titles of restricted

CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover

Apache Airflow Cross-site Scripting Vulnerability

Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability

Potential access to sensitive URLs via CKAN extensions (SSRF)

CKAN has Cross-site Scripting vector in the Datatables view plugin

CKAN may leak Solr credentials via error message in package_search action

Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

Ghost's improper authentication allows access to member information and actions

matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor

Directus has an insecure object reference via PATH presets

Directus has a DOM-Based cross-site scripting (XSS) via layout_options

Trix has a cross-site Scripting vulnerability on copy & paste

WebOb's location header normalization during redirect leads to open redirect