Security advisories

critical2024-05-02

CVE-2024-34392-libxmljs vulnerable to type confusion when parsing specially crafted XML

libxmljs/libxmljs · GHSA-mg49-jqgw-gcj6

critical2024-05-02

CVE-2024-34394-libxmljs2 vulnerable to type confusion when parsing specially crafted XML

marudor/libxmljs2 · GHSA-78h3-pg4x-j8cv

critical2024-05-02

CVE-2024-34391-libxmljs vulnerable to type confusion when parsing specially crafted XML

libxmljs/libxmljs · GHSA-6433-x5p4-8jc7

high2024-05-02

CVE-2024-4216-pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload

pgadmin-org/pgadmin4 · GHSA-xv64-8p4r-94gq

medium2024-05-02

CVE-2024-33394-kubevirt allows a local attacker to execute arbitrary code via a crafted command

kubevirt/kubevirt · GHSA-4q63-mr2m-57hf

medium2024-05-02

CVE-2024-4215-pgAdmin is affected by a multi-factor authentication bypass vulnerability

pgadmin-org/pgadmin4 · GHSA-2mvc-557g-5638

medium2024-05-02

CVE-2024-4029-Wildfly vulnerable to denial of service

wildfly/wildfly · GHSA-x7g6-rwhc-g7mj

high2024-05-02

CVE-2024-34144-Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

jenkinsci/script-security-plugin · GHSA-v63g-v339-2673

low2024-05-02

CVE-2024-4128-Firebase vulnerable to CRSF attack

firebase/firebase-tools · GHSA-rcm2-22f3-pqv3

low2024-05-02

CVE-2024-34147-Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext

jenkinsci/telegram-notifications-plugin · GHSA-94pr-w968-h923

critical2024-05-02

CVE-2024-3955-CraftBeerPi 4 allows arbitrary code execution

pibrewing/craftbeerpi4 · GHSA-4f92-w438-f484

high2024-05-02

CVE-2024-32114-Apache ActiveMQ's default configuration doesn't secure the API web context

apache/activemq · GHSA-gj5m-m88j-v7c3

critical2024-05-02

CVE-2024-32971-Apollo Router vulnerable to Critical Regression In Query Plan Cache

apollographql/router · GHSA-q9p4-hw9m-fj2v

high2024-05-01

CVE-2024-25355-s3-url-parser vulnerable to Denial of Service via regexes component

antoniorecalderusso/s3-url-parser · GHSA-r4q9-xx5g-j24p

critical2024-05-01

CVE-2024-32962-xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing

node-saml/xml-crypto · GHSA-2xp3-57p7-qf4v

high2024-05-01

CVE-2024-32984-Yamux Memory Exhaustion Vulnerability via Active::pending_frames property

libp2p/rust-yamux · GHSA-3999-5ffv-wp2r

low2024-05-01

CVE-2024-31573-XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets

xmlunit/xmlunit · GHSA-chfm-68vv-pvw5

medium2024-05-01

CVE-2024-32966-static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names

static-web-server/static-web-server · GHSA-rwfq-v4hq-h7fg

high2024-05-01

CVE-2024-32970-Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values

phlex-ruby/phlex · GHSA-9p57-h987-4vgx

medium2024-05-01

CVE-2024-32967-Zitadel exposing internal database user name and host information

zitadel/zitadel · GHSA-q5qj-x2h5-3945