Security advisories

medium2024-06-12

CVE-2024-37629-SummerNote Cross Site Scripting Vulnerability

summernote/summernote · GHSA-cc55-mvqc-g9mg

high2024-06-12

CVE-2024-37300-Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

jupyterhub/oauthenticator · GHSA-gprj-3p75-f996

high2024-06-12

CVE-2024-36263-Apache Submarine Server Core has a SQL Injection Vulnerability

apache/submarine · GHSA-v74c-qc46-9gg9

critical2024-06-12

CVE-2024-36265-Apache Submarine Server Core Incorrect Authorization vulnerability

apache/submarine · GHSA-6q97-8v3g-rpxw

medium2024-06-12

CVE-2024-36264-Apache Submarine Commons Utils has a hard-coded secret

apache/submarine · GHSA-jwcg-wv5x-vg3g

medium2024-06-12

CVE-2024-23445-Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions

elastic/elasticsearch · GHSA-4c7q-m7hc-pc92

critical2024-06-12

CVE-2024-4315-parisneo/lollms Local File Inclusion (LFI) attack

parisneo/lollms · GHSA-vqwr-q6cc-c242

critical2024-06-11

CVE-2024-35225-Jupyter Server Proxy has a reflected XSS issue in host parameter

jupyterhub/jupyter-server-proxy · GHSA-fvcq-4x64-hqxr

high2024-06-11

CVE-2024-37301-document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

adfinis/document-merge-service · GHSA-v5gf-r78h-55q6

high2024-06-11

CVE-2024-3656-Keycloak's admin API allows low privilege users to use administrative functions

keycloak/keycloak · GHSA-2cww-fgmg-4jqc

medium2024-06-11

Traefik has unexpected behavior with IPv4-mapped IPv6 addresses

traefik/traefik · GHSA-7jmw-8259-q9jx

high2024-06-11

CVE-2024-35252-Azure Storage Movement Client Library Denial of Service Vulnerability

azure/azure-storage-net-data-movement · GHSA-32f8-hmr3-7vxg

medium2024-06-10

CVE-2024-37168-@grpc/grpc-js can allocate memory for incoming messages well above configured limits

grpc/grpc-node · GHSA-7v5v-9h63-cj86

high2024-06-10

CVE-2024-37166-ghtml Cross-Site Scripting (XSS) vulnerability

gurgunday/ghtml · GHSA-vvhj-v88f-5gxr

high2024-06-10

CVE-2024-35241-Composer has a command injection via malicious git branch name

composer/composer · GHSA-47f6-5gq3-vx9c

high2024-06-10

CVE-2024-35242-Composer has multiple command injections via malicious git/hg branch names

composer/composer · GHSA-v9qv-c7wm-wgmf

high2024-06-10

CVE-2024-37014-Langflow remote code execution vulnerability

langflow-ai/langflow · GHSA-qg33-x2c5-6p44

low2024-06-10

CVE-2021-41089-`docker cp` allows unexpected chmod of host files in Moby Docker Engine

moby/moby · GHSA-v994-f8vw-g7j4

high2024-06-10

CVE-2024-4540-Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)

keycloak/keycloak · GHSA-69fp-7c8p-crjr

high2024-06-10

go-grpc-compression has a zstd decompression bombing vulnerability

mostynb/go-grpc-compression · GHSA-87m9-rv8p-rgmg