Security advisories

medium2024-02-19

CVE-2024-25979-Improper Handling of Parameters in moodle

moodle/moodle · GHSA-6vjf-48fh-vxxj

medium2024-02-19

CVE-2024-26308-Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

apache/commons-compress · GHSA-4265-ccf5-phj5

medium2024-02-19

CVE-2024-25710-Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file

apache/commons-compress · GHSA-4g9r-vxhx-9pgx

medium2024-02-19

CVE-2024-26318-Cross-site Scripting in Serenity

serenity-is/serenity · GHSA-5jjq-8cvj-v6m9

high2024-02-17

CVE-2024-25298-Code injection in REDAXO

redaxo/redaxo · GHSA-7f2v-5877-rx3x

low2024-02-17

CVE-2024-20925-Vulnerability affecting the org.openjfx:javafx-media maven component of the OpenJFX project

openjdk/jfx · GHSA-47g3-mf24-6559

low2024-02-16

tuf's Metadata API: Targets.get_delegated_role() is missing input validation

theupdateframework/python-tuf · GHSA-77hh-43cm-v8j6

high2024-02-16

CVE-2023-45860-Hazelcast Platform permission checking in CSV File Source connector

hazelcast/hazelcast · GHSA-8h4x-xvjp-vf99

high2024-02-16

GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`

koush/scrypted · GHSA-w4hv-vmv9-hgcr

high2024-02-16

CVE-2024-3572-Scrapy decompression bomb vulnerability

scrapy/scrapy · GHSA-7j7m-v7m3-jqm7

low2024-02-16

CVE-2024-24758-Undici proxy-authorization header not cleared on cross-origin redirect in fetch

nodejs/undici · GHSA-3787-6prv-h9w3

medium2024-02-16

CVE-2024-24750-fetch(url) leads to a memory leak in undici

nodejs/undici · GHSA-9f24-jqhm-jfcw

high2024-02-16

CVE-2024-25466-React Native Document Picker Directory Traversal vulnerability

rnmods/react-native-document-picker · GHSA-pmgm-h3cc-m4hj

medium2024-02-16

CVE-2023-49508-YetiForceCRM Directory Traversal vulnerability

yetiforcecompany/yetiforcecrm · GHSA-394m-vxwj-363j

medium2024-02-15

CVE-2024-25620-Helm dependency management path traversal

helm/helm · GHSA-v53g-5gjp-272r

high2024-02-15

CVE-2024-3574-Scrapy authorization header leakage on cross-domain redirect

scrapy/scrapy · GHSA-cw9j-q3vf-hrrv

medium2024-02-15

CVE-2024-20718-Magento Open Source allows Cross-Site Request Forgery (CSRF)

magento/magento2 · GHSA-hqgj-4396-hmxv

medium2024-02-15

CVE-2024-20716-Magento Open Source allows Uncontrolled Resource Consumption

magento/magento2 · GHSA-c9h9-h5gf-885r

high2024-02-15

CVE-2024-20720-Magento Open Source allows OS Command Injection

magento/magento2 · GHSA-525f-pvj5-vqmq

high2024-02-15

CVE-2024-20719-Magento Open Source allows Cross-Site Scripting (XSS)

magento/magento2 · GHSA-264g-f7v8-q5qq