Security advisories

high2024-05-13

CVE-2024-34707-Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages

nautobot/nautobot · GHSA-r2hr-4v48-fjv3

high2024-05-13

CVE-2023-49781-NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

nocodb/nocodb · GHSA-h6r4-xvw6-jc5h

medium2024-05-13

CVE-2024-34708-Directus allows redacted data extraction on the API through "alias"

directus/directus · GHSA-p8v3-m643-4xqx

medium2024-05-13

CVE-2023-50718-NocoDB SQL Injection vulnerability

nocodb/nocodb · GHSA-8fxg-mr34-jqr8

medium2024-05-13

CVE-2023-50717-NocoDB Allows Preview of Files with Dangerous Content

nocodb/nocodb · GHSA-qg73-g3cf-vhhh

low2024-05-13

Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

sparklemotion/nokogiri · GHSA-r95h-9x8f-r3f7

critical2024-05-13

CVE-2024-34706-@valtimo/components exposes access token to form.io

valtimo-platform/valtimo-frontend-libraries · GHSA-xcp4-62vj-cq3r

medium2024-05-13

CVE-2024-34353-matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

matrix-org/matrix-rust-sdk · GHSA-9ggc-845v-gcgv

medium2024-05-13

CVE-2024-34081-Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting

mantisbt/mantisbt · GHSA-wgx7-jp56-65mq

medium2024-05-13

CVE-2024-34080-MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

mantisbt/mantisbt · GHSA-99jc-wqmr-ff2q

high2024-05-13

CVE-2024-34077-Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process

mantisbt/mantisbt · GHSA-93x3-m7pw-ppqm

critical2024-05-13

CVE-2024-34359-llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata

abetlen/llama-cpp-python · GHSA-56xg-wfcc-g829

low2024-05-13

CVE-2024-34079-octo-sts vulnerable to unauthenticated attacker causing unbounded CPU and memory usage

octo-sts/app · GHSA-75r6-6jg8-pfcq

high2024-05-10

CVE-2024-34360-Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX

spacemeshos/go-spacemesh · GHSA-jcqq-g64v-gcm7

medium2024-05-10

CVE-2024-29376-Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book

sylius/sylius · GHSA-7prj-9ccr-hr3q

medium2024-05-10

CVE-2024-34349-Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel

sylius/sylius · GHSA-v2f9-rv6w-vw8r

critical2024-05-10

CVE-2024-34070-Blind XSS Leading to Froxlor Application Compromise

froxlor/froxlor · GHSA-x525-54hf-xr53

critical2024-05-10

CVE-2024-32964-lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

lobehub/lobe-chat · GHSA-mxhq-xw3g-rphc

critical2024-05-09

CVE-2024-4701-Genie Path Traversal vulnerability via File Uploads

netflix/genie · GHSA-wpcv-5jgp-69f3

low2024-05-09

thelounge may publicly disclose of all usernames/idents via port 113

thelounge/thelounge · GHSA-g49q-jw42-6x85