Security advisories

high2024-07-18

CVE-2024-5321-Kubernetes sets incorrect permissions on Windows containers logs

kubernetes/kubernetes · GHSA-82m2-cv7p-4m75

high2024-07-18

CVE-2024-41111-Sliver Allows Authenticated Operator-to-Server Remote Code Execution

bishopfox/sliver · GHSA-hc5w-gxxr-w8x8

low2024-07-18

CVE-2024-40647-Sentry's Python SDK unintentionally exposes environment variables to subprocesses

getsentry/sentry-python · GHSA-g92j-qhmh-64v2

medium2024-07-18

CVE-2024-40648-matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check

matrix-org/matrix-rust-sdk · GHSA-4qg4-cvh2-crgg

high2024-07-18

CVE-2024-40644-gix-path can use a fake program files location

byron/gitoxide · GHSA-mgvv-9p9g-3jv4

medium2024-07-18

CVE-2024-39900-The OpenSearch reporting plugin improperly controls tenancy access to reporting resources

opensearch-project/reporting · GHSA-xmvg-335g-x44q

critical2024-07-18

CVE-2024-39907-1Panel has an SQL injection issue related to the orderBy clause

1panel-dev/1panel · GHSA-5grx-v727-qmq6

high2024-07-18

CVE-2024-29178-Apache StreamPark: FreeMarker SSTI RCE Vulnerability

apache/streampark · GHSA-vv8h-m63v-53pq

medium2024-07-17

CVE-2024-36694-openCart Server-Side Template Injection (SSTI) vulnerability

opencart/opencart · GHSA-xrh7-2gfq-4rcq

medium2024-07-17

CVE-2024-39125-Roundup Cross-site Scripting Vulnerability

roundup-tracker/roundup · GHSA-xjgw-ghrx-wfff

medium2024-07-17

CVE-2024-39126-Roundup Cross-site Scripting Vulnerability

roundup-tracker/roundup · GHSA-x37x-qf4v-f54f

medium2024-07-17

CVE-2024-39124-Roundup Cross-site Scripting Vulnerability

roundup-tracker/roundup · GHSA-w8vc-cwv9-wx67

high2024-07-17

CVE-2024-40641-projectdiscovery/nuclei allows unsigned code template execution through workflows

projectdiscovery/nuclei · GHSA-c3q9-c27p-cw9h

medium2024-07-17

CVE-2024-40640-vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material

matrix-org/vodozemac · GHSA-j8cm-g7r6-hfpq

medium2024-07-17

BlastRADIUS also affects eduMFA

edumfa/edumfa · GHSA-vhmj-5q9r-mm9g

medium2024-07-17

Silverstripe uses TinyMCE which allows svg files linked in object tags

silverstripe/silverstripe-framework · GHSA-52cw-pvq9-9m5v

low2024-07-17

CVE-2024-40636-Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error

steeltoeoss/security-advisories · GHSA-vmcp-66r5-3pcp

low2024-07-17

CVE-2024-40637-dbt has an implicit override for built-in materializations from installed packages

dbt-labs/dbt-core · GHSA-p3f3-5ccg-83xq

medium2024-07-17

CVE-2024-29120-Apache StreamPark: Information leakage vulnerability

apache/incubator-streampark · GHSA-hcf8-5j78-887v

medium2024-07-17

CVE-2024-6833-Zowe CLI allows storage of previously entered secure credentials in a plaintext file

zowe/zowe-cli · GHSA-ghgq-x6wc-6jr5