Security advisories

high2024-08-23

CVE-2024-38807-Signature forgery in Spring Boot's Loader

spring-projects/spring-boot · GHSA-7cj3-x93g-gj76

critical2024-08-22

CVE-2024-45201-LlamaIndex includes an exec call for `import {cls_name}`

run-llama/llama_index · GHSA-fxc2-8m62-m85x

high2024-08-22

CVE-2024-42497-Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams

mattermost/mattermost · GHSA-fxq9-6946-34q7

medium2024-08-22

CVE-2024-43780-Mattermost allows guest user with read access to upload files to a channel

mattermost/mattermost · GHSA-2jhx-w3vc-w59g

medium2024-08-22

CVE-2024-40884-Mattermost allows team admin user without "Add Team Members" permission to disable invite URL

mattermost/mattermost · GHSA-3j95-8g47-fpwh

high2024-08-22

CVE-2024-41659-memos CORS Misconfiguration in server.go (GHSL-2024-034)

usememos/memos · GHSA-p4fx-qf2h-jpmj

medium2024-08-22

CVE-2024-41658-Casdoor has reflected XSS in QrCodePage.js (GHSL-2024-036)

casdoor/casdoor · GHSA-gv2p-4mvg-g32h

high2024-08-22

CVE-2024-41657-Casdoor CORS misconfiguration (GHSL-2024-035)

casdoor/casdoor · GHSA-mchx-7j67-8mcf

low2024-08-22

CVE-2024-43785-gitoxide-core does not neutralize special characters for terminals

byron/gitoxide · GHSA-88g2-r9rw-g55h

low2024-08-22

CVE-2024-43787-Hono CSRF middleware can be bypassed using crafted Content-Type header

honojs/hono · GHSA-rpfr-3m35-5vx5

high2024-08-22

CVE-2024-43398-REXML denial of service vulnerability

ruby/rexml · GHSA-vmwr-mc7x-5vc3

critical2024-08-22

CVE-2024-42490-GoAuthentik vulnerable to Insufficient Authorization for several API endpoints

goauthentik/authentik · GHSA-qxqc-27pr-wgc8

medium2024-08-22

CVE-2024-40886-Mattermost Cross-Site Request Forgery vulnerability

mattermost/mattermost · GHSA-hrf9-rm95-fpf3

medium2024-08-22

CVE-2024-8072-Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

mage-ai/mage-ai · GHSA-cgrq-wvfj-v28j

medium2024-08-22

CVE-2024-39836-Mattermost allows remote/synthetic users to create sessions, reset passwords

mattermost/mattermost · GHSA-c6vp-jjgv-38wj

medium2024-08-22

CVE-2024-8071-Mattermost doesn't restrict which roles can promote a user as system admin

mattermost/mattermost · GHSA-5263-pm2h-m7hw

medium2024-08-22

CVE-2024-32939-Mattermost doesn't redact remote users' original email addresses

mattermost/mattermost · GHSA-4ww8-fprq-cq34

medium2024-08-21

CWA-2024-006: wasmd non-deterministic module_query_safe query

cosmwasm/wasmd · GHSA-fpgj-cr28-fvpx

high2024-08-21

CWA-2024-005: Stackoverflow in wasmd

cosmwasm/wasmd · GHSA-g8w7-7vgg-x7xg

high2024-08-21

CVE-2024-40453-squirrelly Code Injection vulnerability

squirrellyjs/squirrelly · GHSA-w5pw-gmcw-rfc8