Security Advisories | GitStock

high2022-09-30

CVE-2022-39261-Twig may load a template outside a configured directory when using the filesystem loader

twigphp/twig · GHSA-52m2-vc4m-jj33

critical2022-09-30

CVE-2022-39256-Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

orckestra/c1-cms-foundation · GHSA-gfhp-jgp6-838j

high2022-09-30

Lithium vulnerable to Cross Site Scripting in provided Swagger-UI

wireapp/lithium · GHSA-f36p-42jv-8rh2

high2022-09-30

CVE-2022-39248-matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion

matrix-org/matrix-android-sdk2 · GHSA-fpgf-pjjv-2qgm

high2022-09-30

CVE-2022-39246-matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions

matrix-org/matrix-android-sdk2 · GHSA-2pvj-p485-cp3m

high2022-09-30

CVE-2022-39243-NuProcess vulnerable to command-line injection through insertion of NUL character(s)

brettwooldridge/nuprocess · GHSA-cxgf-v2p8-7ph7

high2022-09-30

CVE-2022-39251-matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion

matrix-org/matrix-js-sdk · GHSA-r48r-j8fx-mq2c

high2022-09-30

CVE-2022-39249-matrix-js-sdk subject to impersonated messages due to permissive key forwarding

matrix-org/matrix-js-sdk · GHSA-6263-x97c-c4gg

medium2022-09-30

CVE-2022-3326-rdiffweb vulnerable to password complexity bypass leading to weak passwords

ikus060/rdiffweb · GHSA-8wxf-c45w-g66g

medium2022-09-30

CVE-2022-3355-Inventree vulnerable to Stored Cross-site Scripting

inventree/inventree · GHSA-62g7-fpv9-v95f

medium2022-09-30

CVE-2022-40408-FeehiCMS vulnerable to Cross-Site scripting via crafted payload

liufee/feehicms · GHSA-5mqq-7g25-r4wx

medium2022-09-30

CVE-2022-40931-Dutchoders transfer.sh contains an XSS vulnerability via malicious file upload

dutchcoders/transfer.sh · GHSA-pwq7-f7f9-cm2j

medium2022-09-30

CVE-2021-40692-Moodle Incorrect Authorization

moodle/moodle · GHSA-wr6q-xv23-rfq9

medium2022-09-30

CVE-2021-40691-Moodle Improper Authentication

moodle/moodle · GHSA-92vh-mr2w-j2cr

medium2022-09-30

CVE-2021-40693-Moodle type juggling vulnerability

moodle/moodle · GHSA-2jxg-mv2m-j4r7

medium2022-09-30

CVE-2021-40694-Moodle Improper Encoding or Escaping of Output

moodle/moodle · GHSA-m37g-mwcg-7j7v

medium2022-09-30

CVE-2021-40695-Moodle Exposure of Sensitive Information to an Unauthorized Actor

moodle/moodle · GHSA-gp4w-f57r-9rx3

medium2022-09-30

CVE-2022-3364- rdiffweb's unlimited length Fullname field can lead to DoS

ikus060/rdiffweb · GHSA-fqfg-c577-2vc3

medium2022-09-29

CVE-2022-39236-Improper beacon events in matrix-js-sdk can result in availability issues

matrix-org/matrix-js-sdk · GHSA-hvv8-5v86-r45x

high2022-09-29

d3-color vulnerable to ReDoS

d3/d3-color · GHSA-36jr-mh4h-2g58