Security advisories

high2024-09-05

Interchain Security: The signers of ICS messages do not need to match the provider address

cosmos/interchain-security · GHSA-7q74-g774-7x3g

high2024-09-05

CVE-2024-7884-ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`

dfinity/cdk-rs · GHSA-rwq6-crjg-9cpw

low2024-09-05

CVE-2024-45401-Path traversal vulnerability in stripe-cli

stripe/stripe-cli · GHSA-fv4g-gwpj-74gr

high2024-09-05

CVE-2024-24759-MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

mindsdb/mindsdb · GHSA-4jcv-vp96-94xr

medium2024-09-05

CVE-2024-8462-Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill

windmill-labs/windmill · GHSA-g6q4-w3j3-jfc4

low2024-09-04

CVE-2024-45395-sigstore-go has an unbounded loop over untrusted input can lead to endless data attack

sigstore/sigstore-go · GHSA-cq38-jh5f-37mq

medium2024-09-04

CVE-2024-8391-Vertx gRPC server does not limit the maximum message size

eclipse-vertx/vertx-grpc · GHSA-g76f-gjfx-4rpr

medium2024-09-04

CVE-2024-45314-Flask-AppBuilder's login form allows browser to cache sensitive fields

dpgaspar/flask-appbuilder · GHSA-fw5r-6m3x-rh7p

high2024-09-04

CVE-2024-45053-Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

ethyca/fides · GHSA-c34r-238x-f7qx

low2024-09-04

CVE-2024-45052-Timing-Based Username Enumeration Vulnerability in Fides Webserver Authentication

ethyca/fides · GHSA-2h46-8gf5-fmxv

medium2024-09-04

CVE-2024-43405-Nuclei Template Signature Verification Bypass

projectdiscovery/nuclei · GHSA-7h5p-mmpp-hgmm

medium2024-09-04

CVE-2024-45399-Indico has a Cross-Site-Scripting during account creation

indico/indico · GHSA-rrqf-w74j-24ff

high2024-09-04

CVE-2024-8418-Missing connection timeout in Aardvark-dns

containers/aardvark-dns · GHSA-g5jh-57wm-p79m

medium2024-09-03

pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

pyca/cryptography · GHSA-h4gh-qq45-vh27

high2024-09-03

CVE-2024-45388-Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`)

spectolabs/hoverfly · GHSA-6xx4-x46f-f897

high2024-09-03

@actions/download-artifact has an Arbitrary File Write via artifact extraction

actions/download-artifact · GHSA-cxww-7g56-2vh6

high2024-09-03

CVE-2024-45311-Denial of service in quinn-proto when using `Endpoint::retry()`

quinn-rs/quinn · GHSA-vr26-jcq5-fjj8

low2024-09-03

CVE-2024-45305-gix-path uses local config across repos when it is the highest scope

byron/gitoxide · GHSA-v26r-4c9c-h3j6

medium2024-09-03

CVE-2024-43803-The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD

metal3-io/baremetal-operator · GHSA-pqfh-xh7w-7h3p

high2024-09-03

CVE-2024-42471-@actions/artifact has an Arbitrary File Write via artifact extraction

actions/toolkit · GHSA-6q32-hq47-5qq3