Security advisories

medium2024-12-13

CVE-2024-55890-D-Tale allows Remote Code Execution through the Custom Filter Input

man-group/dtale · GHSA-832w-fhmw-w4f4

medium2024-12-13

CVE-2024-55889-thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames

thorsten/phpmyfaq · GHSA-m3r7-8gw7-qwvc

high2024-12-13

CVE-2024-55887-Ucum-java has an XXE vulnerability in XML parsing

fhir/ucum-java · GHSA-w9j7-phm3-f97j

high2024-12-13

CVE-2024-55661-Laravel Pulse Allows Remote Code Execution via Unprotected Query Method

laravel/pulse · GHSA-8vwh-pr89-4mw2

high2024-12-13

CVE-2024-21543-djoser Authentication Bypass

sunscrapers/djoser · GHSA-v49p-m6gh-747c

medium2024-12-13

CVE-2024-21544-Browsershot Local File Inclusion

spatie/browsershot · GHSA-g2r4-phv7-5fgv

medium2024-12-13

CVE-2024-12289-Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service

hashicorp/boundary · GHSA-xx83-cxmq-x89m

critical2024-12-12

CVE-2024-55662-XWiki allows remote code execution through the extension sheet

xwiki/xwiki-platform · GHSA-j2pq-22jj-4pm5

medium2024-12-12

CVE-2024-55878-Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

shuchkin/simplexlsx · GHSA-x6mh-rjwm-8ph7

medium2024-12-12

CVE-2024-55885-Beego has Collision Hazards of MD5 in Cache Key Filenames

beego/beego · GHSA-9j3m-fr7q-jxfw

high2024-12-12

CVE-2024-55663-XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

xwiki/xwiki-platform · GHSA-wh34-m772-5398

critical2024-12-12

CVE-2024-55875-http4k has a potential XXE (XML External Entity Injection) vulnerability

http4k/http4k · GHSA-7mj5-hjjj-8rgw

medium2024-12-12

CVE-2024-55876-XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

xwiki/xwiki-platform · GHSA-cwq6-mjmx-47p6

critical2024-12-12

CVE-2024-55877-XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList

xwiki/xwiki-platform · GHSA-2r87-74cx-2p7c

critical2024-12-12

CVE-2024-55879-XWiki allows RCE from script right in configurable sections

xwiki/xwiki-platform · GHSA-r279-47wg-chpr

high2024-12-12

Potential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxy

ryanbekhen/nanoproxy · GHSA-7prj-hgx4-2xc3

high2024-12-12

CVE-2024-55633-Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

apache/superset · GHSA-787v-v9vq-4rgv

high2024-12-12

CVE-2024-12397-io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

quarkusio/quarkus-http · GHSA-cxrx-q234-m22m

high2024-12-12

CVE-2024-55587-python-libarchive directory traversal

smartfile/python-libarchive · GHSA-75mx-hw5q-pvx3

critical2024-12-11

CVE-2024-45337-Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

golang/crypto · GHSA-v778-237x-gjrc