Security advisories

low2024-03-26

CVE-2024-29199-Unauthenticated views may expose information to anonymous users

nautobot/nautobot · GHSA-m732-wvh2-7cq4

medium2024-03-25

CVE-2024-27300-phpMyFAQ stored Cross-site Scripting at user email

thorsten/phpmyfaq · GHSA-q7g6-xfh2-vhpx

high2024-03-25

CVE-2024-28105-phpMyFAQ's File Upload Bypass at Category Image Leads to RCE

thorsten/phpmyfaq · GHSA-pwh2-fpfr-x5gf

medium2024-03-25

CVE-2024-28106-phpMyFAQ Stored Cross-site Scripting at FAQ News Content

thorsten/phpmyfaq · GHSA-6p68-36m6-392r

high2024-03-25

CVE-2024-28107-phpMyFAQ SQL injections at insertentry & saveentry

thorsten/phpmyfaq · GHSA-2grw-mc9r-822r

medium2024-03-25

CVE-2024-28108-phpMyFAQ Stored HTML Injection at contentLink

thorsten/phpmyfaq · GHSA-48vw-jpf8-hwqh

medium2024-03-25

CVE-2024-29179-phpMyFAQ Stored Cross-site Scripting at File Attachments

thorsten/phpmyfaq · GHSA-hm8r-95g3-5hj9

high2024-03-25

CVE-2024-27299-phpMyFAQ SQL Injection at "Save News"

thorsten/phpmyfaq · GHSA-qgxx-4xv5-6hcw

medium2024-03-25

CVE-2023-48296-Storefront user can access history and most viewed data from matching back-office user with the same ID

oroinc/orocommerce · GHSA-v7px-46v9-5qwp

high2024-03-25

CVE-2024-29187-WiX based installers are vulnerable to binary hijack when run as SYSTEM

wixtoolset/issues · GHSA-rf39-3f98-xr7r

high2024-03-25

CVE-2024-29188-Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files

wixtoolset/issues · GHSA-jx4p-m4wm-vvjg

high2024-03-25

CVE-2024-28850-WP Crontrol vulnerable to possible RCE when combined with a pre-condition

johnbillion/wp-crontrol · GHSA-9xvf-cjvf-ff5q

medium2024-03-25

CVE-2024-29025-Netty's HttpPostRequestDecoder can OOM

netty/netty · GHSA-5jpm-x58v-624v

medium2024-03-25

CVE-2024-29034-CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

carrierwaveuploader/carrierwave · GHSA-vfmv-jfc5-pjjw

medium2024-03-25

CVE-2024-29041-Express.js Open Redirect in malformed URLs

expressjs/express · GHSA-rv95-896h-c2vc

medium2024-03-25

CVE-2023-45824-Pinned entity creation form shows wrong data

oroinc/platform · GHSA-vxq2-p937-3px3

medium2024-03-25

CVE-2024-28246-KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols

katex/katex · GHSA-3wc5-fcw2-2329

medium2024-03-25

CVE-2024-28245-KaTeX's `\includegraphics` does not escape filename

katex/katex · GHSA-f98w-7cxr-ff2h

medium2024-03-25

CVE-2024-28244-KaTeX's maxExpand bypassed by Unicode sub/superscripts

katex/katex · GHSA-cvr6-37gx-v8wc

medium2024-03-25

CVE-2024-28243-KaTeX's maxExpand bypassed by `\edef`

katex/katex · GHSA-64fm-8hw2-v72w