Security advisories

high2024-10-25

CVE-2022-45157-Exposure of vSphere's CPI and CSI credentials in Rancher

rancher/rancher · GHSA-xj7w-r753-vj8v

critical2024-10-25

CVE-2023-32197-Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

rancher/rancher · GHSA-7h8m-pvw3-5gh4

high2024-10-25

CVE-2024-49757-User Registration Bypass in Zitadel

zitadel/zitadel · GHSA-3rmw-76m6-4gjc

medium2024-10-25

CVE-2024-49753-Denied Host Validation Bypass in Zitadel Actions

zitadel/zitadel · GHSA-6cf5-w9h3-4rqv

high2024-10-25

CVE-2024-49376-Autolab Misconfigured Reset Password Permissions

autolab/autolab · GHSA-v46j-h43h-rwrm

medium2024-10-25

CVE-2023-26248-Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse

libp2p/go-libp2p-kad-dht · GHSA-mqr9-hjr8-2m9w

medium2024-10-24

CVE-2024-49750-The Snowflake Connector for Python stores sensitive data in logs

snowflakedb/snowflake-connector-python · GHSA-5vvg-pvhp-hv2m

medium2024-10-24

CVE-2024-49762-Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

pterodactyl/panel · GHSA-c479-wq8g-57hr

low2024-10-24

AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers

kubernetes-sigs/aws-load-balancer-controller · GHSA-rjfv-pjvx-mjgv

high2024-10-24

CVE-2024-49760-OpenRefine has a path traversal in LoadLanguageCommand

openrefine/openrefine · GHSA-qfwq-6jh6-8xx4

high2024-10-24

CVE-2024-48514-Remote code execution in php-heic-to-jpg

maestroerror/php-heic-to-jpg · GHSA-g8v9-c8m3-942v

high2024-10-24

OpenRefine leaks Google API credentials in releases

openrefine/openrefine · GHSA-3pg4-qwc8-426r

medium2024-10-24

Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)

openrefine/simile-butterfly · GHSA-mpcw-3j5p-p99x

critical2024-10-24

CVE-2024-47883-Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

openrefine/simile-butterfly · GHSA-3p8v-w8mr-m3x8

medium2024-10-24

CVE-2024-47882-OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

openrefine/openrefine · GHSA-j8hp-f2mj-586g

high2024-10-24

CVE-2024-47881-OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)

openrefine/openrefine · GHSA-87cf-j763-vvh8

high2024-10-24

CVE-2024-47880-OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand

openrefine/openrefine · GHSA-79jv-5226-783f

high2024-10-24

CVE-2024-47879-OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)

openrefine/openrefine · GHSA-3jm4-c6qf-jrh3

high2024-10-24

CVE-2024-47878-OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)

openrefine/openrefine · GHSA-pw3x-c5vp-mfc3

medium2024-10-24

CVE-2024-47173-ai-admin-graphql has a Denial of service vulnerability in SaaS and marketplace setups

aimeos/ai-admin-graphql · GHSA-qxgx-hvg3-v92w