Security advisories

medium2024-02-29

CVE-2024-27906-Apache Airflow: DAG Code and Import Error Permissions Ignored

apache/airflow · GHSA-6v6w-h8m6-7mv2

low2024-02-29

CVE-2024-1949-Mattermost race condition

mattermost/mattermost · GHSA-3g35-v53r-gpxc

low2024-02-29

CVE-2024-23488-Mattermost fails to properly restrict the access of files attached to posts

mattermost/mattermost · GHSA-xgxj-j98c-59rv

medium2024-02-29

CVE-2024-1888-Mattermost fails to check the "invite_guest" permission

mattermost/mattermost · GHSA-pfw6-5rx3-xh3c

high2024-02-29

CVE-2024-1887-Mattermost post fetching without auditing in compliance export

mattermost/mattermost · GHSA-fx48-xv6q-6gp3

medium2024-02-29

CVE-2024-23493-Mattermost leaks details of AD/LDAP groups of a teams

mattermost/mattermost · GHSA-7v3v-984v-h74r

medium2024-02-29

CVE-2024-24988-Mattermost denial of service through long emoji value

mattermost/mattermost · GHSA-6mx3-9qfh-77gj

high2024-02-29

CVE-2024-25713-yyjson has a Double Free vulnerability

ibireme/yyjson · GHSA-whx6-m9j4-w2m2

high2024-02-29

CVE-2024-22871-Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service

clojure/clojure · GHSA-vr64-r9qj-h27f

medium2024-02-29

CVE-2024-27516-livehelperchat Server-Side Template Injection

livehelperchat/livehelperchat · GHSA-v4cp-2q7v-hg9q

medium2024-02-29

CVE-2024-26470-FullStackHero's WebAPI Boilerplate host header injection vulnerability

fullstackhero/dotnet-webapi-boilerplate · GHSA-75x2-6h4m-h6mx

medium2024-02-29

CVE-2024-25712-http-swagger XSS via PUT requests

swaggo/http-swagger · GHSA-49w7-5r33-jm9m

medium2024-02-29

CVE-2023-48650-Concrete CMS Stored XSS in Layout Preset Name

concretecms/concretecms · GHSA-x577-gcc9-9xjj

medium2024-02-29

CVE-2023-51774-json-jwt allows bypass of identity checks via a sign/encryption confusion attack

nov/json-jwt · GHSA-c8v6-786g-vjx6

low2024-02-29

CVE-2023-49337-Concrete CMS Stored XSS

concretecms/concretecms · GHSA-9xxv-q6pp-96wq

medium2024-02-29

CVE-2023-50658-jose2go vulnerable to denial of service via large p2c value

dvsekhvalnov/jose2go · GHSA-6294-6rgp-fr7r

medium2024-02-29

CVE-2023-48651-Concrete CMS Cross Site Request Forgery (CSRF) vulnerability

concretecms/concretecms · GHSA-45m2-8q7f-93wv

medium2024-02-29

CVE-2023-48653-Concrete CMS Cross Site Request Forgery (CSRF) vulnerability

concretecms/concretecms · GHSA-3rxx-8f33-7p6p

medium2024-02-28

CVE-2024-25126-Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

rack/rack · GHSA-22f2-v57c-j9cx

low2024-02-28

CVE-2024-26141-Rack has possible DoS Vulnerability with Range Header

rack/rack · GHSA-xj5v-6v4g-jfw6