Security Advisories | GitStock

high2022-10-19

CVE-2022-42188-Lavalite vulnerable to Arbitrary File Read via Directory Traversal

lavalite/cms · GHSA-cm22-88qr-7ffh

medium2022-10-19

CVE-2022-42112-Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

liferay/liferay-portal · GHSA-7f7g-vhff-mjqj

medium2022-10-19

CVE-2022-42116-Liferay Portal and Liferay DXP Vulnerable to XSS in the CKEditor Integration with the Frontend Editor Module

liferay/liferay-portal · GHSA-67jp-27jj-6x85

critical2022-10-19

CVE-2022-39198-Hessian Lite for Apache Dubbo deserialization vulnerability

apache/dubbo-hessian-lite · GHSA-5qwq-g2hx-r6f7

medium2022-10-19

CVE-2022-42467-Apache Isis webconsole module may directly query the database in prototype mode

apache/isis · GHSA-998r-j9rx-qm8m

medium2022-10-19

CVE-2022-42466-Apache Isis Cross-site Scripting vulnerability

apache/isis · GHSA-7pfc-cc9x-8p4m

medium2022-10-18

CVE-2022-39315-Kirby CMS vulnerable to user enumeration in the brute force protection

getkirby/kirby · GHSA-c27j-76xg-6x4f

medium2022-10-18

CVE-2022-39314-Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms

getkirby/kirby · GHSA-43qq-qw4x-28f8

high2022-10-18

CVE-2022-39267-Bifrost vulnerable to authentication check flaw that leads to authentication bypass

brokercap/bifrost · GHSA-mxrx-fg8p-5p5j

medium2022-10-18

CVE-2022-31037-OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration

oroinc/orocommerce · GHSA-4vf4-955g-vxp2

high2022-10-18

CVE-2022-41547-MobSF allows attackers to read arbitrary files via a crafted HTTP request

mobsf/mobile-security-framework-mobsf · GHSA-f42p-vc8p-7x54

medium2022-10-18

Update bundled libxml2 to v2.10.3 to resolve multiple CVEs

sparklemotion/nokogiri · GHSA-2qc6-mcvw-92cw

critical2022-10-18

CVE-2022-39312-MySQL JDBC deserialization vulnerability

dataease/dataease · GHSA-q4qq-jhjv-7rh2

high2022-10-18

Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd

cheqd/cheqd-node · GHSA-j92c-mmf7-j5x5

critical2022-10-18

CVE-2022-39322-Field-level access-control bypass for multiselect field

keystonejs/keystone · GHSA-6mhr-52mv-6v6f

high2022-10-18

CVE-2022-39313-parse-server crashes when receiving file download request with invalid byte range

parse-community/parse-server · GHSA-h423-w6qv-2wj3

high2022-10-18

CVE-2022-3517-minimatch ReDoS vulnerability

isaacs/minimatch · GHSA-f8q6-p94x-37v3

high2022-10-17

CVE-2022-42975-Phoenix before 1.6.14 mishandles check_origin wildcarding

phoenixframework/phoenix · GHSA-p8f7-22gq-m7j9

critical2022-10-16

CVE-2022-42968-Gitea vulnerable to Argument Injection

go-gitea/gitea · GHSA-w8xw-7crf-h23x

high2022-10-16

CVE-2022-41323-Django denial-of-service vulnerability in internationalized URLs

django/django · GHSA-qrw5-5h28-6cmg