Security advisories

high2024-11-19

CVE-2024-52595-HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through

fedora-python/lxml_html_clean · GHSA-5jfw-gq64-q45f

medium2024-11-19

CVE-2024-52522-Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata

rclone/rclone · GHSA-hrxh-9w67-g4cv

medium2024-11-19

CVE-2024-50803-Redaxo Core CMS Cross Site Scripting (XSS)

redaxo/redaxo · GHSA-m5vv-7jxc-8p6x

medium2024-11-19

CVE-2024-52600-Statamic CMS has a Path Traversal in Asset Upload

statamic/cms · GHSA-p7f6-8mcm-fwv3

medium2024-11-19

CVE-2024-31141-Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

apache/kafka · GHSA-2x2g-32r7-p4x8

low2024-11-18

CVE-2024-52587-Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`

step-security/harden-runner · GHSA-g85v-wf27-67xc

medium2024-11-18

CVE-2024-52304-aiohttp allows request smuggling due to incorrect parsing of chunk extensions

aio-libs/aiohttp · GHSA-8495-4g3g-x7pr

medium2024-11-18

CVE-2024-52303-aiohttp has a memory leak when middleware is enabled when requesting a resource with a non-allowed method

aio-libs/aiohttp · GHSA-27mf-ghqm-j3j8

medium2024-11-18

Sharks has a Bias of Polynomial Coefficients in Secret Sharing

c0dearm/sharks · GHSA-jp37-5qhw-mffw

high2024-11-18

CVE-2024-52506-Graylog concurrent PDF report rendering can leak other users' reports

graylog2/graylog2-server · GHSA-vggm-3478-vm5m

high2024-11-18

CVE-2024-48917-XXE in PHPSpreadsheet's XLSX reader

phpoffice/phpspreadsheet · GHSA-7cc9-j4mv-vcjp

high2024-11-18

CVE-2024-47873-XmlScanner bypass leads to XXE

phpoffice/phpspreadsheet · GHSA-jw4x-v69f-hh5w

critical2024-11-18

CVE-2024-47533-cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes

cobbler/cobbler · GHSA-m26c-fcgh-cp6h

medium2024-11-18

CVE-2024-52318-Apache Tomcat - XSS in generated JSPs

apache/tomcat · GHSA-f632-9449-3j4w

critical2024-11-18

CVE-2024-52316-Apache Tomcat - Authentication Bypass

apache/tomcat · GHSA-xcpr-7mr4-h4xq

medium2024-11-18

CVE-2024-48897-moodle: IDOR in edit/delete RSS feed

moodle/moodle · GHSA-x3x9-349x-2485

medium2024-11-18

CVE-2024-52317-Apache Tomcat Request and/or response mix-up

apache/tomcat · GHSA-qvf5-hvjx-wm27

medium2024-11-18

CVE-2024-48901-moodle: IDOR when fetching report schedules

moodle/moodle · GHSA-mg54-p2wj-5ph7

medium2024-11-18

CVE-2024-11319-django CMS Cross-Site Scripting (XSS)

django-cms/django-cms · GHSA-gv5h-5655-h4mv

medium2024-11-18

CVE-2024-48898-moodle: Some users can delete audiences of other reports

moodle/moodle · GHSA-fjq9-452g-jg3q