Security advisories

critical2024-08-01

CVE-2024-39274-Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel

mattermost/mattermost · GHSA-cmc8-222c-vqp9

medium2024-08-01

CVE-2024-36492-Mattermost failed to disallow the modification of local users when syncing users in shared channels

mattermost/mattermost · GHSA-56mc-f9w7-2wxq

high2024-07-31

CVE-2024-40465-Beego privilege escalation vulnerability

beego/beego · GHSA-wr3p-r5fj-wf97

high2024-07-31

CVE-2024-40464-Beego privilege escalation vulnerability

beego/beego · GHSA-r6qh-j42j-pw64

high2024-07-31

CVE-2024-41256-Filestash skips TLS certificate verification process when sending out email verification codes

mickael-kerjean/filestash · GHSA-mpvx-whpp-99xj

high2024-07-31

CVE-2024-41255-Filestash configured to skip TLS certificate verification when using the FTPS protocol

mickael-kerjean/filestash · GHSA-4jmm-c6jw-g796

low2024-07-31

CVE-2024-41949-biscuit-auth vulnerable to public key confusion in third party block

biscuit-auth/biscuit-rust · GHSA-p9w4-585h-g3c7

medium2024-07-31

CVE-2024-41951-PheonixAppAPI has visible Encoding Maps

akshudev/pheonixappapi · GHSA-258h-f687-4226

medium2024-07-31

CVE-2024-41952-ZITADEL "ignoring unknown usernames" vulnerability

zitadel/zitadel · GHSA-567v-6hmg-6qg7

medium2024-07-31

CVE-2024-41953-ZITADEL has improper HTML sanitization in emails and Console UI

zitadel/zitadel · GHSA-v333-7h2p-5fhv

medium2024-07-31

CVE-2024-41955-MobSF vulnerable to Open Redirect in Login Redirect

mobsf/mobile-security-framework-mobsf · GHSA-8m9j-2f32-2vx4

medium2024-07-31

IdentityServer Open Redirect vulnerability

identityserver/identityserver4 · GHSA-55p7-v223-x366

high2024-07-31

CVE-2024-41950-Insecure Jinja2 templates rendered in Haystack Components can lead to RCE

deepset-ai/haystack · GHSA-hx9v-6r9f-w677

medium2024-07-31

CVE-2024-41948-biscuit-java vulnerable to public key confusion in third party block

biscuit-auth/biscuit-java · GHSA-5hcj-rwm6-xmw4

medium2024-07-31

CVE-2024-23444-Elasticsearch stores private key on disk unencrypted

elastic/elasticsearch · GHSA-5v8f-xx9m-wj44

medium2024-07-31

eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

ezsystems/ezplatform-admin-ui · GHSA-gc5h-6jx9-q2qh

critical2024-07-31

CVE-2024-41947-XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution

xwiki/xwiki-platform · GHSA-692v-783f-mg8x

high2024-07-31

CVE-2024-22278-Harbor fails to validate the user permissions when updating project configurations

goharbor/harbor · GHSA-hw28-333w-qxp3

high2024-07-31

CVE-2024-7340-Weave server API vulnerable to arbitrary file leak

wandb/weave · GHSA-r49h-6qxq-624f

medium2024-07-31

CVE-2024-39694-IdentityServer Open Redirect vulnerability

duendesoftware/identityserver · GHSA-ff4q-64jc-gx98