Security advisories

high2024-08-02

CVE-2024-27181-Apache Linkis vulnerable to privilege escalation

apache/linkis · GHSA-v352-rg37-5q5m

high2024-08-02

CVE-2024-27182-Apache Linkis arbitrary file deletion vulnerability

apache/linkis · GHSA-j6vx-r77h-44wc

low2024-08-02

CVE-2024-42459-Elliptic's EDDSA missing signature length check

indutny/elliptic · GHSA-f7q4-pwc6-w24p

low2024-08-02

CVE-2024-42460-Elliptic's ECDSA missing check for whether leading bit of r and s is zero

indutny/elliptic · GHSA-977x-g7h5-7qgw

low2024-08-02

CVE-2024-42461-Elliptic allows BER-encoded signatures

indutny/elliptic · GHSA-49q7-c7j4-3p7m

medium2024-08-02

CVE-2024-41962-Bostr Improper Authorization vulnerability

yonle/bostr · GHSA-5cf7-cxrf-mq73

medium2024-08-01

CVE-2024-41123-REXML DoS vulnerability

ruby/rexml · GHSA-r55c-59qm-vjw6

medium2024-08-01

CVE-2024-41259-Navidrome uses MD5 hashing algorithm

navidrome/navidrome · GHSA-hrmx-8jjv-g758

medium2024-08-01

CVE-2024-4353-Concrete CMS vulnerable to Stored Cross-site Scripting

concretecms/concretecms · GHSA-3cpf-jmmc-8jm3

high2024-08-01

CVE-2024-41265-cortex establishes TLS connections with `InsecureSkipVerify` set to `true`

cortexproject/cortex · GHSA-vw7g-3cc7-7rmh

high2024-08-01

CVE-2024-41260-NetBird uses a static initialization vector (IV)

netbirdio/netbird · GHSA-9v35-4xcr-w9ph

medium2024-08-01

CVE-2024-41264-casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification

casdoor/casdoor · GHSA-67fw-w8f2-88wp

low2024-08-01

CVE-2024-39837-Mattermost did not properly restrict channel creation

mattermost/mattermost · GHSA-vvpg-55p7-5h8w

medium2024-08-01

CVE-2024-39839-Mattermost allows a user on a remote to set their remote username prop to an arbitrary string

mattermost/mattermost · GHSA-vg6q-84p8-qvqh

high2024-08-01

CVE-2024-41144-Mattermost allows remote actor to create/update/delete posts in arbitrary channels

mattermost/mattermost · GHSA-vg67-chm7-8m3j

critical2024-08-01

CVE-2024-39777-Mattermost allows unsolicited invites to expose access to local channels

mattermost/mattermost · GHSA-q22q-2rrf-m27p

medium2024-08-01

CVE-2024-41162-Mattermost allows a remote actor to make an arbitrary local channel read-only

mattermost/mattermost · GHSA-jr9x-3x7m-4j75

medium2024-08-01

CVE-2024-41926-Mattermost allows remote actor to set arbitrary RemoteId values for synced users

mattermost/mattermost · GHSA-9fpw-c9x7-cv3j

medium2024-08-01

CVE-2024-39832-Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling

mattermost/mattermost · GHSA-762m-4cx6-6mf4

medium2024-08-01

CVE-2024-29977-Mattermost failed to properly validate synced reactions

mattermost/mattermost · GHSA-jq3g-xqpx-37x3