Security advisories

critical2024-07-29

CVE-2024-37906-Admidio has Blind SQL Injection in ecard_send.php

admidio/admidio · GHSA-69wx-xc6j-28v3

critical2024-07-29

CVE-2024-41637-RaspAP allows an attacker to escalate privileges

raspap/raspap-webgui · GHSA-q623-2j2j-23jj

high2024-07-26

CVE-2024-41815-Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

starship/starship · GHSA-vx24-x4mv-vwr5

low2024-07-26

XMP Toolkit's `XmpFile::close` can trigger undefined behavior

adobe/xmp-toolkit-rs · GHSA-66fw-43h8-f8p3

high2024-07-26

CVE-2024-41374-ICEcoder vulnerable to Cross Site Scripting

icecoder/icecoder · GHSA-xcr9-pm5w-gvh2

medium2024-07-26

CVE-2024-41373-ICEcoder Path Traversal vulnerability

icecoder/icecoder · GHSA-x38c-v778-w56m

high2024-07-26

CVE-2024-41375-ICEcoder vulnerable to Cross Site Scripting

icecoder/icecoder · GHSA-5j47-3m62-7vr3

medium2024-07-26

CVE-2024-47069-Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar

oveleon/contao-cookiebar · GHSA-296q-rj83-g9rq

medium2024-07-26

CVE-2023-49921-Elasticsearch Insertion of Sensitive Information into Log File

elastic/elasticsearch · GHSA-2hjr-vmf3-xwvp

medium2024-07-25

CVE-2024-7106-Cross-Site Request Forgery in Spina

spinacms/spina · GHSA-wqw3-p83g-r24v

low2024-07-25

CVE-2024-29069-snapd failed to properly check the destination of symbolic links when extracting a snap

snapcore/snapd · GHSA-69p6-gp5x-j269

medium2024-07-25

CVE-2024-29068-snapd failed to properly check the file type when extracting a snap

snapcore/snapd · GHSA-64jh-cjwc-w8q6

medium2024-07-25

CVE-2024-1724-snapd failed to restrict writes to the $HOME/bin path

snapcore/snapd · GHSA-4mh8-9689-38vr

medium2024-07-25

CVE-2024-41800-Craft CMS Allows TOTP Token To Stay Valid After Use

craftcms/cms · GHSA-wmx7-pw49-88jx

low2024-07-25

The kstring integration in gix-attributes is unsound

byron/gitoxide · GHSA-cx7h-h87r-jpgr

high2024-07-25

CVE-2024-41667-OpenAM FreeMarker template injection

openidentityplatform/openam · GHSA-7726-43hg-m23v

critical2024-07-25

CVE-2024-37084-Remote code execution in Spring Cloud Data Flow

spring-cloud/spring-cloud-dataflow · GHSA-p528-3mvf-gr87

high2024-07-24

CVE-2024-40137-Dolibarr ERP CRM vulnerable to remote code execution (RCE)

dolibarr/dolibarr · GHSA-vprp-94p9-5jp8

critical2024-07-24

CVE-2024-36536-fabedge has insecure permissions

fabedge/fabedge · GHSA-c9cm-5j82-m6pj

critical2024-07-24

CVE-2024-36533-Volcano has insecure permissions

volcano-sh/volcano · GHSA-5g3x-8g2v-r8x8