Security Advisories | GitStock

high2022-07-19

CVE-2022-33891-Apache Spark UI can allow impersonation if ACLs enabled

apache/spark · GHSA-4x9r-j582-cgr8

high2022-07-19

CVE-2022-36127-Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header

apache/skywalking-nodejs · GHSA-8gpg-466c-5cpj

medium2022-07-19

CVE-2022-2400-Dompdf before v2.0.0 vulnerable to chroot check bypass

dompdf/dompdf · GHSA-5qj8-6xxj-hp9h

critical2022-07-18

CVE-2020-7677-thenify before 3.3.1 made use of unsafe calls to `eval`.

thenables/thenify · GHSA-29xr-v42j-r956

medium2022-07-18

CVE-2022-31160-jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label

jquery/jquery-ui · GHSA-h6gj-6jjq-h8g9

high2022-07-18

CVE-2021-35065-glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service

gulpjs/glob-parent · GHSA-cj88-88mr-972w

medium2022-07-18

CVE-2022-2099-WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection

woocommerce/woocommerce · GHSA-jwvf-28fg-g4xg

high2022-07-18

CVE-2020-7641-grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload

mikaelkaron/grunt-util-property · GHSA-4hq8-jgr8-mw9j

high2022-07-17

CVE-2021-34538-Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.

apache/hive · GHSA-v3p8-j597-3xg8

critical2022-07-17

CVE-2021-36711-Octobot mishandles Tentacles upload

drakkar-software/octobot · GHSA-fr75-x856-q6j8

medium2022-07-16

CVE-2020-35305-Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog

gollum/gollum · GHSA-fj2w-qmjp-3rjm

high2022-07-16

CVE-2022-25858-Terser insecure use of regular expressions leads to ReDoS

terser/terser · GHSA-4wf5-vphf-c2xc

high2022-07-16

CVE-2022-25891-Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages

containrrr/shoutrrr · GHSA-477v-w82m-634j

critical2022-07-15

CVE-2021-42343-Workers for local Dask clusters mistakenly listened on public interfaces

dask/distributed · GHSA-hwqr-f3v9-hwxr

low2022-07-15

Cilium host policy bypass in endpoint-routes mode with dual-stack

cilium/cilium · GHSA-wc5v-r48v-g4vh

critical2022-07-15

CVE-2022-31180-Shescape vulnerable to insufficient escaping of whitespace

ericcornelissen/shescape · GHSA-44vr-rwwj-p88h

high2022-07-15

CVE-2022-31179-Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD

ericcornelissen/shescape · GHSA-jjc5-fp7p-6f8w

medium2022-07-15

Bypass of CMS Safe Mode Security Feature

wintercms/winter · GHSA-q37h-jhf3-85cj

high2022-07-15

CVE-2021-3859-Undertow vulnerable to Denial of Service (DoS) attacks

undertow-io/undertow · GHSA-339q-62wm-c39w

high2022-07-15

CVE-2021-3690-Undertow vulnerable to memory exhaustion due to buffer leak

undertow-io/undertow · GHSA-fj7c-vg2v-ccrm