Security advisories

high2024-08-12

CVE-2024-29831-Apache DolphinScheduler: RCE by arbitrary js execution

apache/dolphinscheduler · GHSA-m9q4-p56m-mc6q

high2024-08-12

CVE-2024-39338-Server-Side Request Forgery in axios

axios/axios · GHSA-8hc4-vh64-cxmj

high2024-08-12

CVE-2024-30188-Apache DolphinScheduler: Resource File Read And Write Vulnerability

apache/dolphinscheduler · GHSA-4vv4-crw4-8pcw

high2024-08-09

CVE-2024-42473-OpenFGA Authorization Bypass

openfga/openfga · GHSA-3f6g-m4hr-59h8

medium2024-08-09

s2n-tls's mTLS API ordering may skip client authentication

aws/s2n-tls · GHSA-857q-xmph-p2v5

medium2024-08-09

CVE-2024-42468-CometVisu Backend for openHAB has a path traversal vulnerability

openhab/openhab-webui · GHSA-pcwp-26pw-j98w

critical2024-08-09

CVE-2024-42469-CometVisu Backend for openHAB affected by RCE through path traversal

openhab/openhab-webui · GHSA-f729-58x4-gqgf

medium2024-08-09

CVE-2024-42470-CometVisu Backend for openHAB has a sensitive information disclosure vulnerability

openhab/openhab-webui · GHSA-3g4c-hjhr-73rj

high2024-08-09

CVE-2024-42467-CometVisu Backend for openHAB affected by SSRF/XSS

openhab/openhab-webui · GHSA-v7gr-mqpj-wwh3

medium2024-08-09

CVE-2024-42367-In aiohttp, compressed files as symlinks are not protected from path traversal

aio-libs/aiohttp · GHSA-jwhx-xcg6-8xhj

medium2024-08-08

CVE-2024-7394-Concrete CMS Stored XSS in getAttributeSetName

concretecms/concretecms · GHSA-w6j6-w6jx-vf2r

medium2024-08-08

CosmWasm wasmd has large address count in ValidateBasic

cosmwasm/wasmd · GHSA-m3rh-cvr5-x6q4

medium2024-08-08

Gas mispricing in cosmwasm-vm

cosmwasm/wasmvm · GHSA-rg2q-2jh9-447q

medium2024-08-08

CVE-2024-42357-Shopware vulnerable to blind SQL-injection in DAL aggregations

shopware/shopware · GHSA-p6w9-r443-r752

high2024-08-08

CVE-2024-42356-Shopware vulnerable to Server Side Template Injection in Twig using Context functions

shopware/shopware · GHSA-35jp-8cgg-p4wj

high2024-08-08

CVE-2024-42355-Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

shopware/shopware · GHSA-27wp-jvhw-v4xp

medium2024-08-08

CVE-2024-42354-Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

shopware/shopware · GHSA-hhcq-ph6w-494g

high2024-08-08

CVE-2024-41942-JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

jupyterhub/jupyterhub · GHSA-9x4q-3gxw-849f

medium2024-08-08

CVE-2024-6706-Open WebUI Stored Cross-Site Scripting Vulnerability

open-webui/open-webui · GHSA-5jp3-wp5v-5363

high2024-08-07

CVE-2024-7143-Pulp incorrectly assigns RBAC permissions in tasks that create objects

pulp/pulpcore · GHSA-9m5j-4xx9-44j9