Security advisories

critical2024-09-11

omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

omniauth/omniauth-saml · GHSA-cvp8-5r8g-fhvq

medium2024-09-11

Sensitive Information Exposure Through Insecure Logging For Secrets Like Metadata.DockerBuildArgs

aws/aws-sam-cli · GHSA-rjc6-vm4h-85cg

medium2024-09-11

AWS SageMaker Training Toolkit logs CodeArtifact Authorization token

aws/sagemaker-training-toolkit · GHSA-635v-pc42-fr74

high2024-09-11

Untrusted Query Object Evaluation in RPC API

surrealdb/surrealdb · GHSA-64f8-pjgr-9wmr

critical2024-09-11

CVE-2024-6091-AutoGPT bypass of the shell commands denylist settings

significant-gravitas/autogpt · GHSA-g84q-54hf-36rg

medium2024-09-11

CVE-2024-8642-Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit

eclipse-edc/connector · GHSA-8259-2x72-2gvc

medium2024-09-11

CVE-2024-8646-Eclipse Glassfish URL redirection vulnerability

eclipse-ee4j/glassfish · GHSA-7gq2-vwq9-w8vw

high2024-09-11

CVE-2024-21529-dset Prototype Pollution vulnerability

lukeed/dset · GHSA-f6v4-cf5j-vf3w

high2024-09-10

CVE-2024-45596-Session is cached for OpenID and OAuth2 if `redirect` is not used

directus/directus · GHSA-cff8-x7jv-4fm8

medium2024-09-10

CVE-2024-45595-D-Tale vulnerable to Remote Code Execution through the Query input on Chart Builder

man-group/dtale · GHSA-pw44-4h99-wqff

low2024-09-10

CVE-2024-43799-send vulnerable to template injection that can lead to XSS

pillarjs/send · GHSA-m6fv-jmcg-4jfg

low2024-09-10

CVE-2024-43800-serve-static vulnerable to template injection that can lead to XSS

expressjs/serve-static · GHSA-cm22-4g7w-348p

critical2024-09-10

CVE-2024-45409-SAML authentication bypass via Incorrect XPath selector

saml-toolkits/ruby-saml · GHSA-jw9c-mfg7-9rx2

low2024-09-10

CVE-2024-43796-express vulnerable to XSS via response.redirect()

expressjs/express · GHSA-qw6h-vgh9-j6wx

high2024-09-10

CVE-2023-6841-Keycloak Denial of Service vulnerability

keycloak/keycloak · GHSA-w97f-w3hq-36g2

medium2024-09-10

CVE-2024-45591-XWiki Platform document history including authors of any page exposed to unauthorized actors

xwiki/xwiki-platform · GHSA-pvmm-55r5-g3mm

medium2024-09-10

CVE-2024-45592-auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

damienharper/auditor-bundle · GHSA-78vg-7v27-hj67

high2024-09-10

CVE-2024-45590-body-parser vulnerable to denial of service when url encoding is enabled

expressjs/body-parser · GHSA-qwcr-r2fm-qrc7

high2024-09-10

CVE-2024-21528-node-gettext vulnerable to Prototype Pollution

alexanderwallin/node-gettext · GHSA-g974-hxvm-x689

critical2024-09-09

CVE-2024-44902-ThinkPHP deserialization vulnerability

top-think/framework · GHSA-f4wh-359g-4pq7