Security advisories

medium2024-03-06

CVE-2024-27932-Deno's improper suffix match testing for DENO_AUTH_TOKENS

denoland/deno · GHSA-5frw-4rwq-xhcr

medium2024-03-06

CVE-2024-27927-RSSHub vulnerable to Server-Side Request Forgery

diygod/rsshub · GHSA-3p3p-cgj7-vgw3

medium2024-03-06

CVE-2024-27926-RSSHub Cross-site Scripting vulnerability caused by internal media proxy

diygod/rsshub · GHSA-2wqw-hr4f-xrhh

high2024-03-06

PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)

pmmp/pocketmine-mp · GHSA-h6j3-j35f-v2x7

high2024-03-06

PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid

pmmp/pocketmine-mp · GHSA-xc7j-wj36-qjfr

high2024-03-06

CVE-2024-27923-Remote Code Execution by uploading a phar file using frontmatter

getgrav/grav · GHSA-f6g2-h7qv-3m5v

medium2024-03-06

CVE-2023-50740-Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged

apache/linkis · GHSA-m757-p8rv-4q93

medium2024-03-06

CVE-2024-27288-1Panel open source panel project has an unauthorized vulnerability.

1panel-dev/1panel · GHSA-26w3-q4j8-4xjp

medium2024-03-06

CVE-2024-27287-esphome vulnerable to stored Cross-site Scripting in edit configuration file API

esphome/esphome · GHSA-9p43-hj5j-96h5

high2024-03-06

CVE-2024-24767-CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability

icewhaletech/casaos-userservice · GHSA-c69x-5xmw-v44x

medium2024-03-06

CVE-2024-24766-CasaOS Username Enumeration

icewhaletech/casaos-userservice · GHSA-c967-2652-gfjm

high2024-03-06

CVE-2024-24765-CasaOS-UserService allows unauthorized access to any file

icewhaletech/casaos-userservice · GHSA-h5gf-cmm8-cg7c

high2024-03-06

CVE-2024-27917-Shopware's session is persistent in Cache for 404 pages

shopware/shopware · GHSA-c2f9-4jmm-v45m

critical2024-03-06

CVE-2024-26580-Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

apache/inlong · GHSA-p2gx-4434-pf6g

medium2024-03-06

CVE-2024-22889-Phone information disclosure vulnerability

plone/plone · GHSA-xg5p-8wg5-rhxm

medium2024-03-06

CVE-2024-24786-Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON

protocolbuffers/protobuf-go · GHSA-8r3f-844c-mc37

low2024-03-05

CVE-2024-2179-Concrete CMS Stored Cross-site Scripting vulnerability

concretecms/concretecms · GHSA-4m7h-34xm-4wjv

high2024-03-05

CVE-2024-27936-Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping

denoland/deno · GHSA-m4pq-fv2w-6hrw

high2024-03-05

CVE-2024-27935-Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

denoland/deno · GHSA-wrqv-pf6j-mqjp

high2024-03-05

CVE-2024-27929-Use After Free in SixLabors.ImageSharp

sixlabors/imagesharp · GHSA-65x7-c272-7g7r