Security Advisories | GitStock

critical2022-07-23

CVE-2022-25759-convert-svg-core vulnerable to remote code injection

neocotic/convert-svg · GHSA-5gxc-fxcr-9326

critical2022-07-23

CVE-2022-34115-Dataease v1.11.1 SQL Injection via parameter dataSourceId

dataease/dataease · GHSA-vjmr-6pmm-rprf

high2022-07-23

CVE-2022-34114-SQL Injection found in Dataease

dataease/dataease · GHSA-hmvw-66jm-h9fh

medium2022-07-23

CVE-2022-34112-Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin

dataease/dataease · GHSA-c2pj-rr68-pw94

critical2022-07-23

CVE-2022-34113-Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

dataease/dataease · GHSA-5469-c5p2-xv5g

high2022-07-22

CVE-2022-36313-file-type vulnerable to Infinite Loop via malformed MKV file

sindresorhus/file-type · GHSA-mhxj-85r3-2x55

high2022-07-22

CVE-2022-32430-Hardcoded JWT Token in Lin CMS Spring Boot

talelin/lin-cms-spring-boot · GHSA-q72p-4w56-hx7h

critical2022-07-21

Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository

islandora-claw/islandora · GHSA-m58q-qq5h-mgqq

medium2022-07-21

skylot jadx affected by Incorrect Behavior Order in vulnerable dependency

skylot/jadx · GHSA-fjh6-p566-wr6q

medium2022-07-21

CVE-2022-31169-Cranelift vulnerable to miscompilation of constant values in division on AArch64

bytecodealliance/wasmtime · GHSA-7f6x-jwh5-m9r4

high2022-07-21

CVE-2022-31170-OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

openzeppelin/openzeppelin-contracts · GHSA-qh9x-gcfh-pcrw

high2022-07-21

CVE-2022-31163-TZInfo relative path traversal vulnerability allows loading of arbitrary files

tzinfo/tzinfo · GHSA-5cm2-9h8c-rvfx

critical2022-07-21

CVE-2022-35912-Grails framework Remote Code Execution via Data Binding

grails/grails-core · GHSA-6rh6-x8ww-9h97

low2022-07-21

CVE-2022-31151-undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect

nodejs/undici · GHSA-q768-x9m6-m9qp

medium2022-07-21

CVE-2022-31150-undici before v5.8.0 vulnerable to CRLF injection in request headers

nodejs/undici · GHSA-3cvr-822r-rqcc

medium2022-07-20

CVE-2022-31146-Wasmtime vulnerable to Use After Free with `externref`s

bytecodealliance/wasmtime · GHSA-5fhj-g3p3-pq9g

critical2022-07-20

CVE-2016-1000273-Java Melody vulnerable to cross-site scripting

javamelody/javamelody · GHSA-cqhr-jqvc-qw9p

high2022-07-20

CVE-2022-31162-Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs

abdolence/slack-morphism-rust · GHSA-99j7-mhfh-w84p

critical2022-07-19

CVE-2020-28471-Properties-Reader before v2.2.0 vulnerable to prototype pollution

steveukx/properties · GHSA-jxvf-m3x5-mxwq

medium2022-07-19

CVE-2020-28459-markdown-it-decorate vulnerable to cross-site scripting (XSS)

rstacruz/markdown-it-decorate · GHSA-rhf5-2378-3w3w