Security advisories

low2024-06-26

CVE-2024-39458-Exposure of secrets through system log in Jenkins Structs Plugin

jenkinsci/structs-plugin · GHSA-xfx3-cr74-x3cv

medium2024-06-26

CVE-2024-39460-Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin

jenkinsci/bitbucket-branch-source-plugin · GHSA-x8mf-jcmf-r79f

medium2024-06-26

CVE-2024-39459-Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin

jenkinsci/plain-credentials-plugin · GHSA-3cpq-rw36-cppv

low2024-06-26

CVE-2024-24764-October System module has an Open Redirect for Administrator Accounts

octobercms/october · GHSA-v2vf-jv88-3fp5

low2024-06-26

CVE-2024-25637-October System module has a Reflected XSS via X-October-Request-Handler Header

octobercms/october · GHSA-rjw8-v7rr-r563

low2024-06-26

CVE-2024-21520-Cross-site Scripting in djangorestframework

encode/django-rest-framework · GHSA-gw84-84pc-xp82

high2024-06-25

CVE-2024-38526-pdoc embeds link to malicious CDN if math mode is enabled

mitmproxy/pdoc · GHSA-5vgj-ggm4-fg62

critical2024-06-25

CVE-2024-37843-Craft CMS SQL injection vulnerability via the GraphQL API endpoint

craftcms/cms · GHSA-hq4f-mv3q-8wcv

medium2024-06-25

CVE-2024-37820-PingCAP TiDB nil pointer dereference

pingcap/tidb · GHSA-9g6g-xqv5-8g5w

high2024-06-25

CVE-2024-6257-HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

hashicorp/go-getter · GHSA-xfhp-jf8p-mh5w

high2024-06-25

CVE-2024-38516-Aimeos HTML client may potentially reveal sensitive information in error log

aimeos/ai-client-html · GHSA-ppm5-jv84-2xg2

low2024-06-25

CVE-2024-38364-DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document

dspace/dspace · GHSA-94cc-xjxr-pwvf

high2024-06-24

CVE-2024-38374-Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java

cyclonedx/cyclonedx-core-java · GHSA-683x-4444-jxh8

medium2024-06-24

CVE-2024-6104-go-retryablehttp can leak basic auth credentials to log files

hashicorp/go-retryablehttp · GHSA-v6v8-xj6m-xwqh

critical2024-06-24

CVE-2024-38369-XWiki programming rights may be inherited by inclusion

xwiki/xwiki-platform · GHSA-qcj3-wpgm-qpxh

medium2024-06-24

CVE-2023-49793-CodeChecker has a Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`

ericsson/codechecker · GHSA-h26w-r4m5-8rrf

critical2024-06-24

CVE-2024-29868-Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

apache/streampipes · GHSA-cf3q-vg8w-mw84

medium2024-06-24

CVE-2024-27136-Cross site scripting in Apache JSPWiki

apache/jspwiki · GHSA-36gf-vpj2-j42w

medium2024-06-24

CVE-2024-4460-Improper line feed handling in zenml

zenml-io/zenml · GHSA-7gjr-hcc3-xfr4

medium2024-06-24

CVE-2024-3121-Remote Code Execution in create_conda_env function in lollms

parisneo/lollms · GHSA-79h8-gxhq-q3jg