Security advisories

critical2024-12-02

hull.js Code Injection Vulnerability

andriiheonia/hull · GHSA-q849-wxrc-vqrp

critical2024-12-02

CVE-2024-53990-AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s

asynchttpclient/async-http-client · GHSA-mfj5-cf8g-g2fv

medium2024-12-02

ibexa/post-install affected by Breach with Varnish VCL

ibexa/post-install · GHSA-4h8f-c635-25p7

medium2024-12-02

ibexa/http-cache affected by Breach with Varnish VCL

ibexa/http-cache · GHSA-fh7v-q458-7vmw

medium2024-12-02

ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL

ezsystems/ezplatform-http-cache · GHSA-mgfg-7533-7jf6

medium2024-12-02

CVE-2024-53865-Python package "zhmcclient" stores passwords in clear text in its HMC and API logs

zhmcclient/python-zhmcclient · GHSA-p57h-3cmc-xpjq

medium2024-12-02

CVE-2024-53864-Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern

ibexa/admin-ui · GHSA-8w3p-gf85-qcch

low2024-12-02

CVE-2024-53861-PyJWT Issuer field partial matches allowed

jpadilla/pyjwt · GHSA-75c5-xw7c-p5pm

medium2024-12-02

CVE-2024-53848-check-jsonschema default caching for remote schemas allows for cache confusion

python-jsonschema/check-jsonschema · GHSA-q6mv-284r-mp36

medium2024-12-02

CVE-2024-53259-quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

quic-go/quic-go · GHSA-px8v-pp82-rcvr

medium2024-12-02

CVE-2024-52810-@intlify/shared Prototype Pollution vulnerability

intlify/vue-i18n · GHSA-hjwq-mjwj-4x6c

medium2024-12-02

CVE-2024-52809-vue-i18n has cross-site scripting vulnerability with prototype pollution

intlify/vue-i18n · GHSA-9r9m-ffp6-9x4v

medium2024-12-02

CVE-2024-52806-SimpleSAMLphp SAML2 has an XXE in parsing SAML messages

simplesamlphp/saml2 · GHSA-pxm4-r5ph-q2m2

medium2024-12-02

CVE-2024-52801-sftpgo vulnerable to brute force takeover of OpenID Connect session cookies

drakkan/sftpgo · GHSA-6943-qr24-82vx

low2024-12-02

CVE-2024-52800-veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability

verapdf/verapdf-library · GHSA-4cx5-89vm-833x

high2024-12-02

CVE-2024-52596-SimpleSAMLphp xml-common XXE vulnerability

simplesamlphp/xml-common · GHSA-2x65-fpch-2fcm

medium2024-12-02

CVE-2024-52003-Traefik's X-Forwarded-Prefix Header still allows for Open Redirect

traefik/traefik · GHSA-h924-8g65-j9wg

medium2024-12-02

CVE-2024-38827-Spring Framework has Authorization Bypass for Case Sensitive Comparisons

spring-projects/spring-security · GHSA-q3v6-hm2v-pw99

high2024-11-29

CVE-2024-35371-Ant-Media-Server vulnerable to Improper Output Neutralization for Logs

ant-media/ant-media-server · GHSA-2gx6-qrpp-c4p3

medium2024-11-29

CVE-2024-36620-NULL Pointer Dereference on moby image history

moby/moby · GHSA-q59j-vv4j-v33c