Security advisories

medium2024-07-24

CVE-2024-41666-The Argo CD web terminal session does not handle the revocation of user permissions properly

argoproj/argo-cd · GHSA-v8wx-v5jq-qhhw

high2024-07-24

CVE-2023-48362-XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill

apache/drill · GHSA-v62g-jwj9-rfvx

high2024-07-24

CVE-2024-39676-Apache Pinot: Unauthorized endpoint exposed sensitive information

apache/pinot · GHSA-8gj9-r4hv-3jjw

medium2024-07-24

CVE-2024-40767-OpenStack Nova vulnerable to unauthorized access to potentially sensitive data

openstack/nova · GHSA-rm86-h44c-2r2m

high2024-07-23

CVE-2024-41656-Sentry vulnerable to stored Cross-Site Scripting (XSS)

getsentry/sentry · GHSA-fm88-hc3v-3www

medium2024-07-23

CVE-2024-41178-Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

apache/arrow-rs · GHSA-c2hf-vcmr-qjrf

medium2024-07-23

CVE-2024-6783-vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)

vuejs/vue · GHSA-g3ch-rx76-35fx

high2024-07-23

CVE-2024-41655-(ReDoS) Regular Expression Denial of Service in tf2-item-format

danocmx/node-tf2-item-format · GHSA-8h55-q5qq-p685

high2024-07-23

CVE-2024-6717-HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration

hashicorp/nomad · GHSA-5mqx-rpxv-mvxj

critical2024-07-22

CVE-2024-28698-CLSA Directory Traversal vulnerability

marimerllc/csla · GHSA-9xhh-3m78-gvgj

medium2024-07-22

CVE-2024-41132-SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder

sixlabors/imagesharp · GHSA-qxrv-gp6x-rc23

high2024-07-22

CVE-2024-41131-SixLabors ImageSharp Out-of-bounds Write

sixlabors/imagesharp · GHSA-63p8-c4ww-9cg7

medium2024-07-22

CVE-2024-41129-ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

canonical/operator · GHSA-hcmv-jmqh-fjgm

medium2024-07-22

openssl's `MemBio::get_buf` has undefined behavior with empty buffers

sfackler/rust-openssl · GHSA-q445-7m23-qrmw

high2024-07-22

DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks

dnsjava/dnsjava · GHSA-crjg-w57m-rqqf

high2024-07-22

CVE-2024-40634-Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

argoproj/argo-cd · GHSA-jmvp-698c-4x3w

medium2024-07-22

CVE-2024-29073-Anki Latex Incomplete Blocklist Vulnerability

ankitects/anki · GHSA-x3r6-ccvq-cf5v

low2024-07-22

CVE-2024-32152-Ankitects Anki LaTeX Blocklist Bypass vulnerability

ankitects/anki · GHSA-q47p-v5rw-v574

high2024-07-22

CVE-2024-26020-Ankitects Anki arbitrary script execution vulnerability

ankitects/anki · GHSA-9gq7-p5w9-w899

high2024-07-22

DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources

dnsjava/dnsjava · GHSA-mmwx-rj87-vfgr