Security advisories

medium2024-02-22

User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository

treeverse/lakefs · GHSA-fvv5-h29g-f6w5

medium2024-02-22

CVE-2023-44379-baserCMS Cross-site Scripting vulnerability in Site search Feature

baserproject/basercms · GHSA-66c2-p8rh-qx87

medium2024-02-22

CVE-2023-51450-baserCMS OS command injection vulnerability in Installer

baserproject/basercms · GHSA-77fc-4cv5-hmfr

medium2024-02-22

CVE-2024-26128-baserCMS Cross-site Scripting vulnerability in Content Management

baserproject/basercms · GHSA-jjxq-m8h3-4vw5

high2024-02-22

CVE-2024-26147-Helm's Missing YAML Content Leads To Panic

helm/helm · GHSA-r53h-jv2g-vpx6

critical2024-02-22

CVE-2024-25124-Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

gofiber/fiber · GHSA-fmg4-x8pw-hjhg

critical2024-02-22

Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

dompdf/dompdf · GHSA-97m3-52wr-xvv2

medium2024-02-22

CVE-2024-25876-Enhavo Cross-site Scripting vulnerability

enhavo/enhavo-app · GHSA-pcm8-qqrp-w6qf

medium2024-02-22

CVE-2024-25875-Enhavo Cross-site Scripting vulnerability

enhavo/enhavo-app · GHSA-c579-hhw5-cr3p

medium2024-02-22

CVE-2024-25874-Enhavo Cross-site Scripting vulnerability

enhavo/enhavo-app · GHSA-38m8-5gfc-663g

high2024-02-22

CVE-2024-22393-Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability

apache/incubator-answer · GHSA-rmqp-mvv2-54c6

medium2024-02-22

CVE-2024-26578-Apache Answer Race Condition vulnerability

apache/incubator-answer · GHSA-9q24-hwmc-797x

medium2024-02-22

CVE-2024-23349-Apache Answer Cross-site Scripting vulnerability

apache/incubator-answer · GHSA-8pf2-qj4v-fj64

critical2024-02-21

CVE-2024-1597-org.postgresql:postgresql vulnerable to SQL Injection via line comment generation

pgjdbc/pgjdbc · GHSA-24rp-q3w6-vc56

medium2024-02-21

CVE-2024-26138-XWiki extension license information is public, exposing instance id and license holder details

xwikisas/application-licensing · GHSA-4hfp-m9gv-m753

high2024-02-21

CVE-2024-26130-cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override

pyca/cryptography · GHSA-6vqw-3v5j-54x4

medium2024-02-21

CVE-2024-25117-php-svg-lib lacks path validation on font through SVG inline styles

dompdf/php-svg-lib · GHSA-f3qr-qr4x-j273

critical2024-02-21

CVE-2024-23346-pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

materialsproject/pymatgen · GHSA-vgv8-5cpj-qj2f

critical2024-02-21

CVE-2023-47795-Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting

liferay/liferay-portal · GHSA-q2cv-7j58-rfmj

medium2024-02-21

CVE-2024-25151-Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing

liferay/liferay-portal · GHSA-hgr6-6hhw-883f