Advisory Catalog

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads

API Platform Core can leak exceptions message that may contain sensitive information

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_delete of the file c10/cuda/CUDACachingAllocator.cpp. The manipulation leads to memory corruption. An attack has to be approached locally. The ex

Concrete CMS Vulnerable to Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS)

A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler

Drupal Obfuscate Vulnerable to Stored Cross-Site Scripting (XSS)

This module enables users to log in using a short access code instead of providing a username/password combination. The module doesn't sufficiently protect against brute force attacks to guess a user's access code. This vulnerability is mitigated by the fact that access code based logins are off b

tarteaucitron.js allows url scheme injection via unfiltered inputs

Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple times

aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mW

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to

gifplayer XSS vulnerability

AWS SAM CLI Path Traversal allows file copy to local cache

AWS SAM CLI Path Traversal allows file copy to build container

PyTorch is vulnerable to memory corruption through its torch.lstm_cell function

PyTorch is vulnerable to memory corruption through its torch.jit.script function

PyTorch is vulnerable to memory corruption through its unpack_sequence function

PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function

ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field

PyTorch susceptible to local Denial of Service

go.rgst.io/stencil/v2 vulnerable to Path Traversal

ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS)

ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings

ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload

github.com/jaredallard/archives Has Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Pitchfork HTTP Request/Response Splitting vulnerability

Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter

Directus `search` query parameter allows enumeration of non permitted fields

Suspended Directus user can continue to use session token to access API

Directus's S3 assets become unavailable after a burst of HEAD requests

Directus's S3 assets become unavailable after a burst of malformed transformations

Frappe has possibility of SQL injection due to improper validations

wp-svg-upload WordPress plugin vulnerable to Stored Cross-site Scripting

Pixelfed may allow unauthorized actor to view private posts and private users

NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

Frappe has Possibility of Remote Code Execution due to improper validation

Frappe has possibility of SQL injection due to improper validations

A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-base

A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument src.ent

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argum

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated

A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is po