Security advisories

high2024-11-29

CVE-2024-36623-Moby Race Condition vulnerability

moby/moby · GHSA-gh5c-3h97-2f3q

high2024-11-29

CVE-2024-36621-Moby Race Condition vulnerability

moby/moby · GHSA-2mj3-vfvx-fc43

medium2024-11-29

CVE-2024-39162-pyspider Cross-site Scripting vulnerability

binux/pyspider · GHSA-x4x5-jx9j-mmv7

high2024-11-27

CVE-2024-53860-SPEmailHandler-PHP has Potential Abuse for Sending Arbitrary Emails

spencer14420/spemailhandler-php · GHSA-mj5r-x73q-fjw6

medium2024-11-27

CVE-2024-53858-Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts

cli/cli · GHSA-jwcm-9g39-pmcw

medium2024-11-27

CVE-2024-53859-`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace

cli/go-gh · GHSA-55v3-xh23-96gh

medium2024-11-27

CVE-2024-11862-Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications

devolutions/xts.net · GHSA-j6vm-4r7g-x4gr

high2024-11-27

CVE-2024-49203-Querydsl vulnerable to HQL injection through orderBy

openfeign/querydsl · GHSA-6q3q-6v5j-h6vg

medium2024-11-26

CVE-2024-8676-CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

cri-o/cri-o · GHSA-7p9f-6x8j-gxxp

medium2024-11-26

CVE-2024-43784-Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

treeverse/lakefs · GHSA-hh33-46q4-hwm2

medium2024-11-26

CVE-2024-51058-TCPDF Local File Inclusion vulnerability

tecnickcom/tcpdf · GHSA-rmv2-8jjc-23xw

medium2024-11-26

CVE-2024-53843-@dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling

dapperduckling/keycloak-connector · GHSA-w5rq-g9r6-vrcg

medium2024-11-26

CVE-2024-53267-sigstore-java has vulnerability with bundle verification

sigstore/sigstore-java · GHSA-q4xm-6fjc-5f6w

low2024-11-26

CVE-2024-52008-Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API

ethyca/fides · GHSA-v7vm-rhmg-8j2r

high2024-11-26

CVE-2024-32965-@lobehub/chat Server Side Request Forgery vulnerability

lobehub/lobe-chat · GHSA-2xcc-vm3f-m8rw

high2024-11-25

CVE-2024-10039-Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination

keycloak/keycloak · GHSA-93ww-43rr-79v3

medium2024-11-25

CVE-2024-9666-Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

keycloak/keycloak · GHSA-jgwc-jh89-rpgq

medium2024-11-25

CVE-2024-52529-Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges

cilium/cilium · GHSA-xg58-75qf-9r67

low2024-11-25

CVE-2024-32468-deno_doc's HTML generator vulnerable to Cross-site Scripting

denoland/deno · GHSA-qqwr-j9mm-fhw6

high2024-11-25

CVE-2024-10451-Keycloak Build Process Exposes Sensitive Data

keycloak/keycloak · GHSA-v7gv-xpgf-6395