Security advisories

medium2024-10-04

CVE-2024-47211-OpenStack Ironic fails to verify checksums of supplied image_source URLs

openstack/ironic · GHSA-8h22-6qwx-q4w9

medium2024-10-04

CVE-2024-47855-JSON-lib mishandles an unbalanced comment string

kordamp/json-lib · GHSA-wwcp-26wc-3fxm

high2024-10-03

@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source

saltcorn/saltcorn · GHSA-fm76-w8jw-xf8m

low2024-10-03

CVE-2024-9266-Express Open Redirect vulnerability

expressjs/express · GHSA-jj78-5fmv-mv28

high2024-10-03

@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings

saltcorn/saltcorn · GHSA-78p3-fwcq-62c2

medium2024-10-03

@saltcorn/server arbitrary file and directory listing when accessing build mobile app results

saltcorn/saltcorn · GHSA-cfqx-f43m-vfh7

medium2024-10-03

@saltcorn/server arbitrary file zip read and download when downloading auto backups

saltcorn/saltcorn · GHSA-277h-px4m-62q8

high2024-10-03

CVE-2024-47614-async-graphql Directive Overload

async-graphql/async-graphql · GHSA-5gc2-7c65-8fq8

medium2024-10-03

Sentry SDK Prototype Pollution gadget in JavaScript SDKs

getsentry/sentry-javascript · GHSA-593m-55hh-j8gv

medium2024-10-03

CVE-2024-47617-Injection of arbitrary HTML/JavaScript code through the media download URL

sulu/sulu · GHSA-6784-9c82-vr85

medium2024-10-03

CVE-2024-47618-Cross-site Scripting via uploaded SVG

sulu/sulu · GHSA-255w-87rh-rg44

medium2024-10-03

CVE-2024-8038-Vulnerable juju introspection abstract UNIX domain socket

juju/juju · GHSA-xwgj-vpm9-q2rq

medium2024-10-03

CVE-2024-8037-Vulnerable juju hook tool abstract UNIX domain socket

juju/juju · GHSA-8v4w-f4r9-7h6x

high2024-10-03

CVE-2024-9313-PAM module may allow accessing with the credentials of another user

ubuntu/authd · GHSA-x5q3-c8rm-w787

low2024-10-03

OpenTofu potential leaking of secret variable values when using static evaluation in v1.8

opentofu/opentofu · GHSA-wpr2-j6gr-pjw9

medium2024-10-03

CVE-2024-47762-Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

backstage/backstage · GHSA-qc4v-xq2m-65wc

medium2024-10-03

CVE-2024-7558-JUJU_CONTEXT_ID is a predictable authentication secret

juju/juju · GHSA-mh98-763h-m9v4

critical2024-10-03

CVE-2024-47561-Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

apache/avro · GHSA-r7pg-v2c8-mfg3

high2024-10-03

CVE-2024-47554-Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader

apache/commons-io · GHSA-78wr-2p64-hpwj

high2024-10-02

CVE-2024-47616-Pomerium service account access token may grant unintended access to databroker API

pomerium/pomerium · GHSA-r7rh-jww5-5fjr