Security advisories

critical2024-04-10

CVE-2024-31997-XWiki Platform remote code execution from account through UIExtension parameters

xwiki/xwiki-platform · GHSA-c2gg-4gq4-jv5j

critical2024-04-10

CVE-2024-31996-XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

xwiki/xwiki-commons · GHSA-hf43-47q4-fhq5

medium2024-04-10

CVE-2024-31995-zcap has incomplete expiration checks in capability chains.

digitalbazaar/zcap · GHSA-hp8h-7x69-4wmv

high2024-04-10

CVE-2024-31999-@fastify/secure-session: Reuse of destroyed secure session cookie

fastify/fastify-secure-session · GHSA-9wwp-q7wq-jx35

low2024-04-10

Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output

kopia/kopia · GHSA-j5vm-7qcc-2wwg

critical2024-04-10

CVE-2024-31988-XWiki Platform CSRF remote code execution through the realtime HTML Converter API

xwiki/xwiki-platform · GHSA-r5vh-gc3r-r24w

critical2024-04-10

CVE-2024-31987-XWiki Platform remote code execution from account via custom skins support

xwiki/xwiki-platform · GHSA-cv55-v6rw-7r5v

critical2024-04-10

CVE-2024-31986-XWiki Platform CSRF remote code execution through scheduler job's document reference

xwiki/xwiki-platform · GHSA-37m4-hqxv-w26g

medium2024-04-10

CVE-2024-31985-XWiki Platform CSRF in the job scheduler

xwiki/xwiki-platform · GHSA-j2r6-r929-v6gf

critical2024-04-10

CVE-2024-31984-XWiki Platform: Remote code execution through space title and Solr space facet

xwiki/xwiki-platform · GHSA-xm4h-3jxr-m3c6

critical2024-04-10

CVE-2024-31983-XWiki Platform: Remote code execution from edit in multilingual wikis via translations

xwiki/xwiki-platform · GHSA-xxp2-9c9g-7wmj

critical2024-04-10

CVE-2024-31982-XWiki Platform: Remote code execution as guest via DatabaseSearch

xwiki/xwiki-platform · GHSA-2858-8cfx-69m9

critical2024-04-10

CVE-2024-31981-XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

xwiki/xwiki-platform · GHSA-vxwr-wpjv-qjq7

critical2024-04-10

CVE-2024-31465-XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

xwiki/xwiki-platform · GHSA-34fj-r5gq-7395

medium2024-04-10

CVE-2024-31464-XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted

xwiki/xwiki-platform · GHSA-v782-xr4w-3vqx

high2024-04-10

CVE-2024-22423-yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)

yt-dlp/yt-dlp · GHSA-hjq6-52gw-2g7p

high2024-04-10

CVE-2024-20758-Magento Open Source allows Improper Input Validation

magento/magento2 · GHSA-wh4m-6rh3-p4rq

medium2024-04-10

CVE-2024-29296-Portainer CE allows username enumeration through authentication response timing

portainer/portainer · GHSA-87x6-8m9v-g8c2

medium2024-04-10

CVE-2024-20759-Magento Open Source allows Cross-Site Scripting (XSS)

magento/magento2 · GHSA-59vf-hjxc-f9c5

medium2024-04-10

CVE-2024-21507-mysql2 cache poisoning vulnerability

sidorares/node-mysql2 · GHSA-mqr2-w7wj-jjgr