Security advisories

high2024-03-22

CVE-2024-28116-Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

getgrav/grav · GHSA-c9gp-64c4-2rrh

high2024-03-22

CVE-2024-27921-Grav File Upload Path Traversal

getgrav/grav · GHSA-m7hx-hw6h-mqmc

medium2024-03-22

CVE-2024-28593-Cross-site Scripting in Moodle Chat

moodle/moodle · GHSA-f6mh-79vh-2hv7

medium2024-03-22

CVE-2024-29272-VvvebJs Arbitrary File Upload vulnerability

givanz/vvvebjs · GHSA-pmm3-68q9-57jg

medium2024-03-22

CVE-2024-29271-VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability

givanz/vvvebjs · GHSA-pc95-3wgm-x28p

medium2024-03-21

CVE-2024-29374-Cross site scripting in moodle

moodle/moodle · GHSA-3qw5-v9cc-v262

high2024-03-21

CVE-2024-29180-Path traversal in webpack-dev-middleware

webpack/webpack-dev-middleware · GHSA-wr3j-pwj9-hqq6

high2024-03-21

CVE-2024-29019-ESPHome vulnerable to Authentication bypass via Cross site request forgery

esphome/esphome · GHSA-5925-88xh-6h99

medium2024-03-21

CVE-2024-29131-Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()

apache/commons-configuration · GHSA-xjp4-hw94-mvp5

medium2024-03-21

CVE-2024-28635-Cross-site scripting in Survey Creator

surveyjs/survey-creator · GHSA-xgj4-2hrf-j4xg

medium2024-03-20

Ibexa Kernel's files with blacklisted extensions can be still saved to drafts

ibexa/core · GHSA-9j39-4686-m3c4

medium2024-03-20

Ibexa Kernel's files with blacklisted extensions can be still saved to drafts

ezsystems/ezplatform-kernel · GHSA-mwvh-p3hx-x4gg

high2024-03-20

CVE-2024-1394-Memory leaks in code encrypting and verifying RSA payloads

golang-fips/openssl · GHSA-78hx-gp6g-7mj6

high2024-03-20

CVE-2024-29033-GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

jupyterhub/oauthenticator · GHSA-55m3-44xf-hg4h

medium2024-03-20

CVE-2024-29018-Moby's external DNS requests from 'internal' networks could lead to data exfiltration

moby/moby · GHSA-mq39-4gv4-mvpx

low2024-03-20

CVE-2024-28868-Umbraco possible user enumeration

umbraco/umbraco-cms · GHSA-552f-97wf-pmpq

medium2024-03-20

CVE-2024-29032-`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code

qiskit/qiskit-ibm-runtime · GHSA-x4x5-jv3x-9c7m

low2024-03-20

Dynamic Variable Evaluation in qiskit-ibm-runtime

qiskit/qiskit-ibm-runtime · GHSA-cq96-9974-v8hm

critical2024-03-20

CVE-2024-28179-Jupyter Server Proxy's Websocket Proxying does not require authentication

jupyterhub/jupyter-server-proxy · GHSA-w3vc-fx9p-wp4v

medium2024-03-20

CVE-2024-23821-GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)

geoserver/geoserver · GHSA-88wc-fcj9-q3r9