Security Advisories | GitStock

low2023-01-10

CVE-2023-22489-Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted

flarum/framework · GHSA-hph3-hv3c-7725

medium2023-01-10

CVE-2023-22488-Flarum notifications can leak restricted content

flarum/framework · GHSA-8gcg-vwmw-rxj4

high2023-01-10

CVE-2023-22487-Flarum post mentions can be used to read any post on the forum without access control

flarum/framework · GHSA-22m9-m3ww-53h3

high2023-01-10

CVE-2023-0163-convict vulnerable to Prototype Pollution

mozilla/node-convict · GHSA-4jrm-c32x-w4jf

medium2023-01-10

CVE-2022-46176-Cargo did not verify SSH host keys

rust-lang/cargo · GHSA-r5w3-xm58-jv6j

medium2023-01-10

CVE-2021-46871-phoenix_html allows Cross-site Scripting in HEEx class attributes

phoenixframework/phoenix_html · GHSA-5g2h-9x5v-5h3x

high2023-01-10

CVE-2023-22895-bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow

alexcrichton/bzip2-rs · GHSA-96jv-r488-c2rj

medium2023-01-10

CVE-2023-22899-Zip4j Origin Validation Error

srikanth-lingala/zip4j · GHSA-2pj2-gchf-wmw7

medium2023-01-10

PocketMine-MP vulnerable to denial-of-service by sending large modal form responses

pmmp/pocketmine-mp · GHSA-7m9r-rq9j-wmmh

high2023-01-09

CVE-2023-22480-KubeOperator allows unauthorized access to system API

kubeoperator/kubeoperator · GHSA-jxgp-jgh3-8jc8

high2023-01-09

CVE-2023-22479-KubePi session fixation attack allows an attacker to hijack a legitimate user session.

kubeoperator/kubepi · GHSA-v4w5-r2xc-7f8h

high2023-01-09

CVE-2023-22478-KubePi may allow unauthorized access to system API

kubeoperator/kubepi · GHSA-gqx8-hxmv-c4v4

medium2023-01-09

CVE-2023-22477-mercurius has Uncaught Exception when using subscriptions

mercurius-js/mercurius · GHSA-cm8h-q92v-xcfc

high2023-01-09

CVE-2022-46648-ruby-git has potential remote code execution vulnerability

ruby-git/ruby-git · GHSA-pfpr-3463-c6jh

high2023-01-09

PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash

pmmp/pocketmine-mp · GHSA-wqqv-jcfr-9f5g

medium2023-01-09

CVE-2022-3145-@okta/oidc-middlewareOpen Redirect vulnerability

okta/okta-oidc-middleware · GHSA-58h4-9m7m-j9m4

medium2023-01-09

Apiman Manager API affected by Jackson denial of service vulnerability

apiman/apiman · GHSA-q95j-488q-5q3p

high2023-01-09

CVE-2022-23509-Gitops Run insecure communication

weaveworks/weave-gitops · GHSA-89qm-wcmw-3mgg

high2023-01-09

CVE-2022-23508-GitOps Run allows for Kubernetes workload injection

weaveworks/weave-gitops · GHSA-wr3c-g326-486c

high2023-01-09

CVE-2023-22467-Luxon Inefficient Regular Expression Complexity vulnerability

moment/luxon · GHSA-3xq5-wjfh-ppjc