Security advisories

medium2024-09-18

CVE-2024-46979-org.xwiki.platform:xwiki-platform-notifications-ui leaks data of notification filters of users

xwiki/xwiki-platform · GHSA-pg4m-3gp6-hw4w

high2024-09-18

CVE-2024-46978-org.xwiki.platform:xwiki-platform-notifications-ui is missing checks for notification filter preferences editions

xwiki/xwiki-platform · GHSA-r95w-889q-x2gx

medium2024-09-17

CVE-2024-4629-Keycloak Services has a potential bypass of brute force protection

keycloak/keycloak · GHSA-gc7q-jgjv-vjr2

high2024-09-17

CVE-2024-46982-Next.js Cache Poisoning

vercel/next.js · GHSA-gp8f-8m3g-qvj9

medium2024-09-17

CVE-2024-8796-Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length

devise-two-factor/devise-two-factor · GHSA-qjxf-mc72-wjr2

medium2024-09-17

CVE-2024-46976-@backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection

backstage/backstage · GHSA-5j94-f3mf-8685

low2024-09-17

CVE-2024-45384-druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability

apache/druid · GHSA-p72w-r6fv-6g5h

low2024-09-17

CVE-2024-45537-Apache Druid: Users can provide MySQL JDBC properties not on allow list

apache/druid · GHSA-jh66-3545-vpm7

medium2024-09-17

CVE-2024-8660-Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block

concretecms/concretecms · GHSA-998c-q8hh-h8gv

high2024-09-17

CVE-2024-45816-@backstage/plugin-techdocs-backend storage bucket Directory Traversal vulnerability

backstage/backstage · GHSA-39v3-f278-vj3g

high2024-09-17

CVE-2024-45815-@backstage/plugin-catalog-backend Prototype Pollution vulnerability

backstage/backstage · GHSA-3x3f-jcp3-g22j

critical2024-09-17

hermes-management is vulnerable to RCE due to Apache commons-jxpath

allegro/hermes · GHSA-2gh6-wc3m-g37f

medium2024-09-17

CVE-2024-45812-Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

vitejs/vite · GHSA-64vr-g452-qvp3

medium2024-09-17

CVE-2024-45811-Vite's `server.fs.deny` is bypassed when using `?import&raw`

vitejs/vite · GHSA-9cwx-2883-4wfx

high2024-09-17

Kimai has an XXE Leading to Local File Read

kimai/kimai · GHSA-534c-hcr7-67jg

medium2024-09-17

CVE-2024-8939-vLLM Denial of Service via the best_of parameter

vllm-project/vllm · GHSA-wc36-9694-f9rf

high2024-09-17

CVE-2024-8768-vLLM denial of service vulnerability

vllm-project/vllm · GHSA-w2r7-9579-27hf

medium2024-09-17

CVE-2024-45803-Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content

wireui/wireui · GHSA-rw5h-g8xq-6877

high2024-09-17

CVE-2024-45606-Sentry improperly authorizes muting of alert rules

getsentry/sentry · GHSA-v345-w9f2-mpm5

high2024-09-17

CVE-2024-45605-Sentry improperly authorizes deletion of user issue alert notifications

getsentry/sentry · GHSA-54m3-95j9-v89j