Security advisories

critical2024-08-20

CVE-2024-43202-Apache Dolphinscheduler Code Injection vulnerability

apache/dolphinscheduler · GHSA-2fm6-mv57-p2qh

medium2024-08-20

CVE-2024-38810-Spring Security Missing Authorization vulnerability

spring-projects/spring-security · GHSA-hmqf-wpq9-jq83

critical2024-08-19

CVE-2024-43401-In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them

xwiki/xwiki-platform · GHSA-f963-4cq8-2gw7

critical2024-08-19

CVE-2024-43400-XWiki Platform allows XSS through XClass name in string properties

xwiki/xwiki-platform · GHSA-wcg9-pgqv-xm5v

high2024-08-19

CVE-2024-43399-Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files

mobsf/mobile-security-framework-mobsf · GHSA-4hh3-vj32-gr6j

medium2024-08-19

CVE-2024-43380-fugit parse and parse_nat stall on lengthy input

floraison/fugit · GHSA-2m96-52r3-2f3g

low2024-08-19

CVE-2024-43379-Trufflehog vulnerable to Blind SSRF in some Detectors

trufflesecurity/trufflehog · GHSA-3r74-v83p-f4f4

medium2024-08-19

SQLx Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

launchbadge/sqlx · GHSA-xmrp-424f-vfpx

high2024-08-19

CVE-2024-44076-Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access

microcks/microcks · GHSA-r6ph-5fp2-3w2v

high2024-08-18

CVE-2024-6221-Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

corydolphin/flask-cors · GHSA-hxwh-jpp2-84pm

low2024-08-16

CVE-2024-42850-Silverpeas vulnerable to password complexity rule bypass

silverpeas/silverpeas-core · GHSA-h6jq-w432-j26w

medium2024-08-16

CVE-2024-42486-Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API

cilium/cilium · GHSA-vwf8-q6fw-4wcm

medium2024-08-15

Stack overflow when parsing specially crafted JSON ABI strings

alloy-rs/core · GHSA-8327-84cj-8xjm

medium2024-08-15

CVE-2024-42487-Gateway API route matching order contradicts specification

cilium/cilium · GHSA-qcm3-7879-xcww

medium2024-08-15

CVE-2024-42488-Policy bypass for Host Firewall policy due to race condition in Cilium agent

cilium/cilium · GHSA-q7w8-72mr-vpgw

high2024-08-15

CVE-2024-42681-Improper Preservation of Permissions in xxl-job

xuxueli/xxl-job · GHSA-cpfp-m5qw-c4r3

high2024-08-15

CVE-2024-43370-gettext.js has a Cross-site Scripting injection

guillaumepotier/gettext.js · GHSA-vwhg-jwr4-vxgg

high2024-08-14

CVE-2024-43410-Russh has an OOM Denial of Service due to allocation of untrusted amount

eugeny/russh · GHSA-vgvv-x7xg-6cqg

high2024-08-14

GitHub Actions Script Injection in `ultralytics/actions`

ultralytics/actions · GHSA-7x29-qqmq-v6qc

high2024-08-14

CVE-2024-43367-Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

boa-dev/boa · GHSA-f67q-wr6w-23jq