Security advisories

medium2024-07-31

CVE-2024-39318-Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

ibexa/admin-ui · GHSA-qm44-wjm2-pr59

critical2024-07-31

CVE-2024-37901-XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet

xwiki/xwiki-platform · GHSA-h63h-5c77-77p5

high2024-07-31

CVE-2024-37900-XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

xwiki/xwiki-platform · GHSA-wf3x-jccf-5g5g

medium2024-07-31

CVE-2024-37898-XWiki Platform vulnerable to document deletion and overwrite from edit

xwiki/xwiki-platform · GHSA-33gp-gmg3-hfpq

medium2024-07-31

CVE-2024-7300-Bolt CMS Cross-site Scripting vulnerability

bolt/bolt · GHSA-xhqw-4hcq-fcvr

high2024-07-30

CVE-2024-38986-@75lb/deep-merge Prototype Pollution vulnerability

75lb/deep-merge · GHSA-28mc-g557-92m7

low2024-07-30

CVE-2024-41945-The fuels-ts typescript SDK has no awareness of to-be-spent transactions

fuellabs/fuels-ts · GHSA-3jcg-vx7f-j6qf

high2024-07-30

CVE-2023-33976-TensorFlow has segfault in array_ops.upper_bound

tensorflow/tensorflow · GHSA-gjh7-xx4r-x345

high2024-07-30

CVE-2024-38909-Studio 42 elFinder vulnerable to Incorrect Access Control

studio-42/elfinder · GHSA-3h9f-mm2x-4j58

critical2024-07-30

pREST vulnerable to jwt bypass + sql injection

prest/prest · GHSA-wm25-j4gw-6vr3

medium2024-07-30

CVE-2024-41109-Pimcore vulnerable to disclosure of system and database information behind /admin firewall

pimcore/admin-ui-classic-bundle · GHSA-fx6j-9pp6-ph36

critical2024-07-30

CVE-2024-41110-Authz zero length regression

moby/moby · GHSA-v23v-6jw2-98fq

high2024-07-30

CVE-2023-48396-Apache SeaTunnel Web Authentication vulnerability

apache/seatunnel · GHSA-cp2c-x2pc-fph7

medium2024-07-29

CVE-2024-6578-Aim Stored Cross-site Scripting Vulnerability

aimhubio/aim · GHSA-p9f2-jg9w-cx69

high2024-07-29

CVE-2024-41818-fast-xml-parser vulnerable to ReDOS at currency parsing

naturalintelligence/fast-xml-parser · GHSA-mpg4-rc92-vx8v

medium2024-07-29

CVE-2024-41810-Twisted vulnerable to HTML injection in HTTP redirect body

twisted/twisted · GHSA-cf56-g6w6-pqq2

high2024-07-29

CVE-2024-41799-tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users

tgstation/tgstation-server · GHSA-c3h4-9gc2-f7h4

medium2024-07-29

CVE-2024-41676-Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

openmage/magento-lts · GHSA-5vrp-638w-p8m2

medium2024-07-29

CVE-2024-41671-twisted.web has disordered HTTP pipeline response

twisted/twisted · GHSA-c8m8-j448-xjx7

critical2024-07-29

CVE-2024-38529-Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

admidio/admidio · GHSA-g872-jwwr-vggm