Security advisories

high2024-05-15

OpenCFP Framework (Sentry) Account takeover via null password reset codes

cartalyst/sentry · GHSA-2m5g-8xpw-42vp

medium2024-05-15

Denial of Service in extension "Code Highlight" (codehighlight)

brotkrueml/codehighlight · GHSA-4cv2-xc5f-px8h

medium2024-05-15

Denial of Service in extension "Code Highlight" (codehighlight)

brotkrueml/codehighlight · GHSA-65xh-hh78-6454

medium2024-05-15

amphp/http Host Header Injection vulnerability

amphp/http · GHSA-8v5x-6vv5-jv4g

medium2024-05-15

amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance

amphp/artax · GHSA-gm98-g2wf-7c68

medium2024-05-15

amphp/http-client Header leakage on cross-domain redirects

amphp/http-client · GHSA-8jp9-mpv9-98rj

medium2024-05-15

asymmetricrypt/asymmetricrypt Padding Oracle Vulnerability in RSA Encryption

cosmicist/asymmetricrypt · GHSA-87mp-xc4x-x8rh

high2024-05-15

pygmentize Remote Code Execution

dedalozzo/pygmentize · GHSA-77mv-mp2j-gxxh

medium2024-05-15

goreleaser shows environment by default

goreleaser/goreleaser · GHSA-f6mm-5fc7-3g3c

high2024-05-15

CVE-2024-34082-Grav Vulnerable to Arbitrary File Read to Account Takeover

getgrav/grav · GHSA-f8v5-jmfh-pr69

critical2024-05-15

CVE-2024-32888-Amazon JDBC Driver for Redshift SQL Injection via line comment generation

aws/amazon-redshift-jdbc-driver · GHSA-x3wm-hffr-chwm

medium2024-05-15

CVE-2024-31216-source-controller leaks Azure Storage SAS token into logs

fluxcd/source-controller · GHSA-v554-xwgw-hc3w

medium2024-05-15

CVE-2024-3744-azure-file-csi-driver leaks service account tokens in the logs

kubernetes-sigs/azurefile-csi-driver · GHSA-qjqg-4wg7-957h

medium2024-05-14

CVE-2024-35175-sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address

tg123/sshpiper · GHSA-4w53-6jvp-gg52

high2024-05-14

CVE-2022-36062-Grafana folders admin only permission privilege escalation

grafana/grafana · GHSA-p978-56hq-r492

high2024-05-14

CVE-2022-39201-Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

grafana/grafana · GHSA-x744-mm8v-vpgr

medium2024-05-14

CVE-2022-39229-Grafana when using email as a username can block other users from signing in

grafana/grafana · GHSA-gj7m-853r-289r

high2024-05-14

CVE-2022-39306-Grafana Email addresses and usernames can not be trusted

grafana/grafana · GHSA-2x6g-h2hg-rq84

high2024-05-14

CVE-2022-39307-Grafana User enumeration via forget password

grafana/grafana · GHSA-3p62-42x7-gxg5

medium2024-05-14

CVE-2022-39324-Grafana Spoofing originalUrl of snapshots

grafana/grafana · GHSA-4724-7jwc-3fpw