Security Advisories | GitStock

medium2022-09-16

CVE-2022-36056-Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature

sigstore/cosign · GHSA-8gw7-4j42-w388

medium2022-09-16

CVE-2022-36020-TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection

typo3/html-sanitizer · GHSA-47m6-46mj-p235

high2022-09-16

CVE-2022-36049-Helm Controller denial of service

fluxcd/flux2 · GHSA-p2g7-xwvr-rrw3

medium2022-09-16

CVE-2022-36032-ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent

reactphp/http · GHSA-w3w9-vrf5-8mx8

high2022-09-16

CVE-2022-36076-NodeBB account takeover via SSO plugins

nodebb/nodebb · GHSA-xmgg-fx9p-prq6

medium2022-09-16

CVE-2022-36082-mangadex-downloader vulnerable to unauthorized file reading

mansuf/mangadex-downloader · GHSA-r9x7-2xmr-v8fw

medium2022-09-16

CVE-2022-36083-JOSE vulnerable to resource exhaustion via specifically crafted JWE

panva/jose · GHSA-jv3g-j58f-9mq9

critical2022-09-16

CVE-2022-36084-cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch

aeb-labs/cruddl · GHSA-qm4w-4995-vg7f

high2022-09-16

CVE-2022-36085-OPA Compiler: Bypass of WithUnsafeBuiltins using "with" keyword to mock functions

open-policy-agent/opa · GHSA-f524-rf33-2jjr

high2022-09-16

CVE-2022-36086-linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

rust-osdev/linked-list-allocator · GHSA-xg8p-34w2-j49j

high2022-09-16

CVE-2022-36090-XWiki Platform Improper Authorization check for inactive users

xwiki/xwiki-platform · GHSA-jgc8-gvcx-9vfx

high2022-09-16

CVE-2022-36091-XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor

xwiki/xwiki-platform · GHSA-599v-w48h-rjrm

high2022-09-16

CVE-2022-36096-XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list

xwiki/xwiki-platform · GHSA-gjmq-x5x7-wc36

high2022-09-16

CVE-2022-36097-XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

xwiki/xwiki-platform · GHSA-9r9j-57rf-f6vj

critical2022-09-16

CVE-2022-36098-XWiki Platform Mentions UI vulnerable to Cross-site Scripting

xwiki/xwiki-platform · GHSA-c5v8-2q4r-5w9v

critical2022-09-16

CVE-2022-36099-XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

xwiki/xwiki-platform · GHSA-xr6m-2p4m-jvqf

critical2022-09-16

CVE-2022-36100-XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

xwiki/xwiki-platform · GHSA-2g5c-228j-p52x

high2022-09-16

CVE-2022-36103-Talos worker join token can be used to get elevated access level to the Talos API

siderolabs/talos · GHSA-7hgc-php5-77qq

high2022-09-16

CVE-2022-40023-mako is vulnerable to Regular Expression Denial of Service

sqlalchemy/mako · GHSA-v973-fxgf-6xhp

critical2022-09-16

wee_alloc is Unmaintained

rustwasm/wee_alloc · GHSA-rc23-xxgq-x27g