Security advisories

low2024-02-28

CVE-2024-26146-Rack Header Parsing leads to Possible Denial of Service Vulnerability

rack/rack · GHSA-54rr-7fvw-6x8f

medium2024-02-28

CVE-2024-25169-Mezzanine allows attackers to bypass access control mechanisms

stephenmcd/mezzanine · GHSA-qp56-82vp-xqgv

medium2024-02-28

CVE-2024-25170-Mezzanine allows attackers to bypass access controls via manipulating the Host header

stephenmcd/mezzanine · GHSA-22cc-w7xm-rfhx

medium2024-02-28

CVE-2024-27285-YARD's default template vulnerable to Cross-site Scripting in generated frames.html

lsegal/yard · GHSA-8mq4-9jjh-9xrc

critical2024-02-28

CVE-2024-25128-Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID

dpgaspar/flask-appbuilder · GHSA-j2pw-vp55-fqqj

medium2024-02-28

CVE-2024-27083-Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

dpgaspar/flask-appbuilder · GHSA-fqxj-46wg-9v84

low2024-02-28

ASA-2024-004: Default configuration param for Evidence may limit window of validity

cometbft/cometbft · GHSA-555p-m4v6-cqxv

medium2024-02-28

CVE-2024-24779-Apache Superset: Improper data authorization when creating a new dataset

apache/superset · GHSA-wr6g-9wcr-cmqj

medium2024-02-28

CVE-2024-26016-Apache Superset: Improper authorization validation on dashboards and charts import

apache/superset · GHSA-3v9r-885j-762g

medium2024-02-28

CVE-2024-24772-Apache Superset: Improper Neutralization of custom SQL on embedded context

apache/superset · GHSA-m6jm-3v38-76j4

medium2024-02-28

CVE-2024-24773-Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

apache/superset · GHSA-5474-f7g5-273q

medium2024-02-28

CVE-2024-27315-Apache Superset: Improper error handling on alerts

apache/superset · GHSA-h7r6-8qmm-hj5r

medium2024-02-28

CVE-2024-22723-Webtrees Path Traversal vulnerability

fisharebest/webtrees · GHSA-6w5q-79rf-7c49

low2024-02-27

ASA-2024-005: Potential slashing evasion during re-delegation

cosmos/cosmos-sdk · GHSA-86h5-xcpx-cfqc

high2024-02-27

CVE-2023-45859-Missing permission checks on Hazelcast client protocol

hazelcast/hazelcast · GHSA-xh6m-7cr7-xx66

medium2024-02-27

Magento LTS vulnerable to stored XSS in admin file form

openmage/magento-lts · GHSA-gp6m-fq6h-cjcx

medium2024-02-27

CVE-2024-26144-Rails has possible Sensitive Session Information Leak in Active Storage

rails/rails · GHSA-8h22-8cf7-hq6g

medium2024-02-27

CVE-2024-26143-Rails has possible XSS Vulnerability in Action Controller

rails/rails · GHSA-9822-6m93-xqf4

low2024-02-27

CVE-2024-26142-Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch

rails/rails · GHSA-jjhx-jhvp-74wq

critical2024-02-27

Transparent TLS may not be applied to Marbles with certain manifest configurations

edgelesssys/marblerun · GHSA-x5r5-2qrx-rqj8