Security advisories

medium2024-12-20

CVE-2024-56331-uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor

louislam/uptime-kuma · GHSA-2qgm-m29m-cj2h

high2024-12-20

CVE-2024-56329-Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback

joelbutcher/socialstream · GHSA-3q97-vjpp-c8rp

medium2024-12-20

CVE-2024-21549-Browsershot Improper Input Validation vulnerability

spatie/browsershot · GHSA-c9f5-29f6-c35w

medium2024-12-20

CVE-2024-12678-Hashicorp Nomad Incorrect Privilege Assignment vulnerability

hashicorp/nomad · GHSA-hr68-hvgv-xxqf

high2024-12-19

CVE-2024-55196-GoPhish sends cleartext passwords

gophish/gophish · GHSA-rv83-h68q-c4wq

high2024-12-19

CVE-2024-38819-Spring Framework Path Traversal vulnerability

spring-projects/spring-framework · GHSA-g5vr-rgqm-vf78

medium2024-12-19

CVE-2024-12798-QOS.CH logback-core Expression Language Injection vulnerability

qos-ch/logback · GHSA-pr98-23f8-jwxv

low2024-12-19

CVE-2024-12801-QOS.CH logback-core Server-Side Request Forgery vulnerability

qos-ch/logback · GHSA-6v67-2wr5-gvf4

high2024-12-19

CVE-2024-25131-OpenShift Must Gather Operator Improper Input Validation vulnerability

openshift/must-gather-operator · GHSA-77c2-c35q-254w

high2024-12-19

WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service

clidey/whodb · GHSA-5pf6-cq2v-23ww

high2024-12-19

CVE-2024-56327-pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

woodruffw/pyrage · GHSA-47h8-jmp3-9f28

high2024-12-19

CVE-2024-56159-Astro's server source code is exposed to the public if sourcemaps are enabled

withastro/astro · GHSA-49w6-73cw-chjr

critical2024-12-18

CVE-2024-56145-Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

craftcms/cms · GHSA-2p6p-9rc9-62j9

medium2024-12-18

age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

filosottile/age · GHSA-32gq-x56h-299c

medium2024-12-18

rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

str4d/rage · GHSA-4fg7-vxc8-qx5w

high2024-12-18

TShock Security Escalation Exploit

pryaxis/tshock · GHSA-hvm9-wc8j-mgrc

medium2024-12-18

`Slip10Like` derivation method instantiated with certain curves may allow attacker to find derivation path which results into very long derivation (possible DoS)

lfdt-lockness/hd-wallet · GHSA-2ff4-xfpr-m32r

low2024-12-18

Prototype pollution in jsii.configureCategories

aws/jsii-compiler · GHSA-m56h-5xx3-2jc2

low2024-12-18

CVE-2024-56128-Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm

apache/kafka · GHSA-p7c9-8xx8-h74f

medium2024-12-18

CVE-2024-56140-Atro CSRF Middleware Bypass (security.checkOrigin)

withastro/astro · GHSA-c4pw-33h3-35xw