Security advisories

medium2024-12-03

CVE-2024-53999-Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality

mobsf/mobile-security-framework-mobsf · GHSA-5jc6-h9w7-jm3p

medium2024-12-03

CVE-2024-53867-Synapse Matrix has a partial room state leak via Sliding Sync

element-hq/synapse · GHSA-56w4-5538-8v8h

high2024-12-03

CVE-2024-53863-Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders

element-hq/synapse · GHSA-vp6v-whfm-rv3g

medium2024-12-03

CVE-2024-53257-Vitess allows HTML injection in /debug/querylogz & /debug/env

vitessio/vitess · GHSA-7mwh-q3xm-qh6p

high2024-12-03

CVE-2024-52815-Synapse allows a a malformed invite to break the invitee's `/sync`

element-hq/synapse · GHSA-f3r3-h2mq-hx2h

high2024-12-03

CVE-2024-52805-Synapse allows unsupported content types to lead to memory exhaustion

element-hq/synapse · GHSA-rfq8-j7rh-8hf2

medium2024-12-03

CVE-2024-37303-Synapse's unauthenticated writes to the media repository allow planting of problematic content

element-hq/synapse · GHSA-gjgr-7834-rhxr

high2024-12-03

CVE-2024-37302-Synapse denial of service through media disk space consumption

element-hq/synapse · GHSA-4mhg-xv73-xq2x

high2024-12-03

CVE-2024-45106-Apache Ozone: Improper authentication when generating S3 secrets

apache/ozone · GHSA-rcq8-9q3j-98mw

low2024-12-02

CVE-2024-53989-rails-html-sanitizer has XSS vulnerability with certain configurations

rails/rails-html-sanitizer · GHSA-rxv5-gxqc-xx8g

medium2024-12-02

CVE-2024-53862-Access to Archived Argo Workflows with Fake Token in `client` mode

argoproj/argo-workflows · GHSA-h36c-m3rf-34h9

medium2024-12-02

CVE-2024-53264-BunkerWeb has Open Redirect Vulnerability in Loading Page

bunkerity/bunkerweb · GHSA-q9rr-h3hx-m87g

low2024-12-02

CVE-2024-53987-rails-html-sanitizer has XSS vulnerability with certain configurations

rails/rails-html-sanitizer · GHSA-2x5m-9ch4-qgrr

low2024-12-02

CVE-2024-53988-rails-html-sanitizer has XSS vulnerability with certain configurations

rails/rails-html-sanitizer · GHSA-cfjx-w229-hgx5

low2024-12-02

CVE-2024-53986-rails-html-sanitizer has XSS vulnerability with certain configurations

rails/rails-html-sanitizer · GHSA-638j-pmjw-jq48

low2024-12-02

CVE-2024-53985-rails-html-sanitize has XSS vulnerability with certain configurations

rails/rails-html-sanitizer · GHSA-w8gc-x259-rc7x

high2024-12-02

CVE-2024-53981-Denial of service (DoS) via deformation `multipart/form-data` boundary

kludex/python-multipart · GHSA-59g5-xgcq-4qw3

medium2024-12-02

CVE-2024-53983-Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery

backstage/backstage · GHSA-qmc2-jpr5-7rg9

medium2024-12-02

`ruzstd` uninit and out-of-bounds memory reads

killingspark/zstd-rs · GHSA-x3f4-45xf-rjm7

high2024-12-02

CVE-2024-53900-Mongoose search injection vulnerability

automattic/mongoose · GHSA-m7xq-9374-9rvx