Security advisories

high2024-03-16

CVE-2024-22259-Spring Framework URL Parsing with Host Validation Vulnerability

spring-projects/spring-framework · GHSA-hgjh-9rj2-g67j

medium2024-03-15

CVE-2024-27351-Regular expression denial-of-service in Django

django/django · GHSA-vm8q-m57g-pff3

high2024-03-15

CLI for Vela Insecure Variable Substitution

go-vela/cli · GHSA-4jhj-3gv3-c3gr

high2024-03-15

Golang SDK for Vela Insecure Variable Substitution

go-vela/sdk-go · GHSA-v8mx-hp2q-gw85

high2024-03-15

Server/API for Vela Insecure Variable Substitution

go-vela/server · GHSA-69p4-j5v5-x234

high2024-03-15

Types for Vela Insecure Variable Substitution

go-vela/types · GHSA-7v38-w32m-wx4m

high2024-03-15

CVE-2024-28854-tls-listener affected by the slow loris vulnerability with default configuration

tmccombs/tls-listener · GHSA-2qph-qpvm-2qf7

high2024-03-15

CVE-2024-28181-TurboBoost Commands vulnerable to arbitrary method invocation

hopsoft/turbo_boost-commands · GHSA-mp76-7w5v-pr75

critical2024-03-15

CVE-2024-28175-Cross-site scripting on application summary component

argoproj/argo-cd · GHSA-jwv5-8mqv-g387

high2024-03-15

CVE-2024-28252-CoreWCF NetFraming based services can leave connections open when they should be closed

corewcf/corewcf · GHSA-32jq-mv89-5rx7

low2024-03-15

fgr Vulnerable to Insecure Default Variable Initialization

dan1hc/fgr · GHSA-879p-8gw4-mcpw

high2024-03-15

CVE-2024-27920-Nuclei allows unsigned code template execution through workflows

projectdiscovery/nuclei · GHSA-w5wx-6g2r-r78q

medium2024-03-15

CVE-2024-2497-RaspAP Vulnerable to Code Injection via an Unknown Process in File `includes/provider.php`

raspap/raspap-webgui · GHSA-99wg-vmvq-2cp5

critical2024-03-15

CVE-2024-27102-Pterodactyl Wings vulnerable to improper isolation of server file access

pterodactyl/wings · GHSA-494h-9924-xww9

medium2024-03-15

CVE-2024-24770-vantage6 vulnerable to a username timing attack on recover password/MFA token

vantage6/vantage6 · GHSA-5h3x-6gwf-73jm

medium2024-03-15

CVE-2024-23823-vantage6's CORS settings overly permissive

vantage6/vantage6 · GHSA-4946-85pr-fvxh

medium2024-03-15

CVE-2023-51699-Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime

fluid-cloudnative/fluid · GHSA-wx8q-4gm9-rj2g

medium2024-03-15

CVE-2023-50726-Users with `create` but not `override` privileges can perform local sync

argoproj/argo-cd · GHSA-g623-jcgg-mhmm

medium2024-03-15

CVE-2024-23944-Apache ZooKeeper vulnerable to information disclosure in persistent watchers handling

apache/zookeeper · GHSA-r978-9m6m-6gm6

critical2024-03-15

CVE-2024-28752-SSRF vulnerability using the Aegis DataBinding in Apache CXF

apache/cxf · GHSA-qmgx-j96g-4428