Security advisories

medium2024-10-01

CVE-2024-45967-Pagekit Cross-site Scripting vulnerability

pagekit/pagekit · GHSA-xw32-6422-frqm

medium2024-10-01

CVE-2024-21531-git-shallow-clone Argument Injection vulnerability

10uei011/git-shallow-clone · GHSA-qwrq-vxvw-537r

high2024-10-01

CVE-2024-21489-uPlot Prototype Pollution vulnerability

leeoniya/uplot · GHSA-34q8-jcq6-mc37

medium2024-09-30

CVE-2024-47536- starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

starcitizentools/mediawiki-skins-citizen · GHSA-62r2-gcxr-426x

high2024-09-30

CVE-2024-47178-basic-auth-connect's callback uses time unsafe string comparison

expressjs/basic-auth-connect · GHSA-7p89-p6hx-q4fw

medium2024-09-30

CVE-2024-45792-MantisBT vulnerable to information disclosure with user profiles

mantisbt/mantisbt · GHSA-h5q3-fjp4-2x7r

high2024-09-30

CVE-2024-47532-RestrictedPython information leakage via `AttributeError.obj` and the `string` module

zopefoundation/restrictedpython · GHSA-5rfv-66g4-jr8h

medium2024-09-30

CVE-2024-9329-Eclipse Glassfish improperly handles http parameters

eclipse-ee4j/glassfish · GHSA-jq3f-mfmg-747x

medium2024-09-27

CVE-2024-47186-Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting

filamentphp/filament · GHSA-9h9q-qhxg-89xr

low2024-09-27

CVE-2024-9283-ReLaXed Cross-site Scripting vulnerability

relaxedjs/relaxed · GHSA-gj3p-j74v-3x57

medium2024-09-27

CVE-2024-9277-Inefficient Regular Expression Complexity in langflow

langflow-ai/langflow · GHSA-355v-2rjx-fpx7

high2024-09-26

CVE-2024-7594-Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

hashicorp/vault · GHSA-jg74-mwgw-v6x3

high2024-09-26

CVE-2024-22030-Rancher agents can be hijacked by taking over the Rancher Server URL

rancher/rancher · GHSA-h4h5-9833-v2p4

low2024-09-26

CVE-2024-47171-Agnai vulnerable to Relative Path Traversal in Image Upload

agnaistic/agnai · GHSA-g54f-66mw-hv66

low2024-09-26

CVE-2024-47170-Agnai File Disclosure Vulnerability: JSON via Path Traversal

agnaistic/agnai · GHSA-h355-hm5h-cm8h

critical2024-09-26

CVE-2024-47169-Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

agnaistic/agnai · GHSA-mpch-89gm-hm83

medium2024-09-26

CVE-2024-47075-Layui has DOM Clobbering gadgets that leads to Cross-site Scripting

layui/layui · GHSA-j827-6rgf-9629

medium2024-09-26

CVE-2024-45042-Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials

ory/kratos · GHSA-wc43-73w7-x2f5

medium2024-09-26

CVE-2024-39319-IDOR vulnerability in account profile page

aimeos/ai-controller-frontend · GHSA-rw3j-574h-mrcq

medium2024-09-26

CVE-2024-47003-Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events

mattermost/mattermost · GHSA-59hf-mpf8-pqjh