Security advisories

high2024-04-02

CVE-2024-0637-Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability

centreon/centreon · GHSA-22v7-v3mj-pm8r

medium2024-04-01

CVE-2024-3135-LocalAI cross-site request forgery vulnerability

mudler/localai · GHSA-jhvf-7c85-3c9g

high2024-04-01

CVE-2024-30250-In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists

kindspells/astro-shield · GHSA-c4gr-q97g-ppwc

high2024-04-01

CVE-2024-30248-Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

piccolo-orm/piccolo_admin · GHSA-pmww-v6c9-7p83

medium2024-04-01

CVE-2024-28232-CasaOS Username Enumeration - Bypass of CVE-2024-24766

icewhaletech/casaos-userservice · GHSA-hcw2-2r9c-gc6p

medium2024-04-01

CVE-2024-27609-Bonita cross-site scripting vulnerability

bonitasoft/bonita-engine · GHSA-8vj9-5v5q-fhch

high2024-03-29

CVE-2024-29900-@electron/packager's build process memory potentially leaked into final executable

electron/packager · GHSA-34h3-8mw4-qw57

medium2024-03-29

CVE-2024-29901-@workos-inc/authkit-nextjs session replay vulnerability

workos/authkit-nextjs · GHSA-35w3-6qhc-474v

medium2024-03-29

CVE-2024-29200-Kimai API returns timesheet entries a user should not be authorized to view

kimai/kimai · GHSA-cj3c-5xpm-cx94

medium2024-03-29

CVE-2024-28867-Un-sanitized metric name or labels can be used to take over exported metrics

swift-server/swift-prometheus · GHSA-x768-cvr2-345r

medium2024-03-29

CVE-2024-29893-ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability

argoproj/argo-cd · GHSA-jhwx-mhww-rgc3

high2024-03-29

CVE-2024-29896-Content-Security-Policy header generation in middleware could be compromised by malicious injections

kindspells/astro-shield · GHSA-w387-5qqw-7g8m

high2024-03-29

CVE-2024-29686-Winter CMS Server-Side Template Injection (SSTI) vulnerability

wintercms/winter · GHSA-8r5j-gm3j-cx9c

high2024-03-29

CVE-2024-29640-aliyundrive-webdav vulnerable to Command Injection

messense/aliyundrive-webdav · GHSA-73v2-rxqp-7q4f

high2024-03-29

CVE-2024-29904-CodeIgniter4 DoS Vulnerability

codeigniter4/codeigniter4 · GHSA-39fp-mqmm-gxj6

medium2024-03-29

CVE-2024-23449-Elasticsearch Uncaught Exception leading to crash

elastic/elasticsearch · GHSA-pw39-f3m5-cxfc

medium2024-03-29

CVE-2024-29316-Incorrect Access Control in NodeBB

nodebb/nodebb · GHSA-qc99-r4wh-c8h6

medium2024-03-28

CVE-2024-1753-Podman affected by CVE-2024-1753 container escape at build time

containers/podman · GHSA-874v-pj72-92f3

medium2024-03-28

CVE-2024-29886-Serverpod improved security for stored password hashes

serverpod/serverpod · GHSA-r75m-26cq-mjxc

high2024-03-28

CVE-2024-29887-Serverpod client accepts any certificate

serverpod/serverpod · GHSA-h6x7-r5rg-x5fw