Security Advisories | GitStock

medium2024-01-24

CVE-2024-23901-Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin

jenkinsci/gitlab-branch-source-plugin · GHSA-fw9h-cxx9-gfq3

low2024-01-24

CVE-2024-23903-Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin

jenkinsci/gitlab-branch-source-plugin · GHSA-f67f-2j6r-m4c9

medium2024-01-24

CVE-2024-23900-Path traversal vulnerability in Jenkins Matrix Project Plugin

jenkinsci/matrix-project-plugin · GHSA-cjgm-9vc9-56mx

medium2024-01-24

CVE-2024-23902-CSRF vulnerability in Jenkins GitLab Branch Source Plugin

jenkinsci/gitlab-branch-source-plugin · GHSA-8r93-59cf-358f

critical2024-01-24

CVE-2024-23897-Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

jenkinsci/jenkins · GHSA-6f9g-cxwr-q5jr

high2024-01-24

CVE-2024-23898-Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

jenkinsci/jenkins · GHSA-53ph-2r2x-vqw8

high2024-01-24

CVE-2023-50944-Apache Airflow: Bypass permission verification to read code of other dags

apache/airflow · GHSA-vm5m-qmrx-fw8w

medium2024-01-24

CVE-2023-51702-Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

apache/airflow · GHSA-mg2x-mggj-6955

high2024-01-24

CVE-2023-50943-Apache Airflow: pickle deserialization vulnerability in XComs

apache/airflow · GHSA-c3c6-f2ww-xfr2

high2024-01-24

CVE-2024-23641-Sending a GET or HEAD request with a body crashes SvelteKit

sveltejs/kit · GHSA-g5m6-hxpp-fc49

medium2024-01-24

CVE-2024-23633-Cross-site Scripting Vulnerability on Data Import

humansignal/label-studio · GHSA-fq23-g58m-799r

high2024-01-24

CVE-2023-47115-Cross-site Scripting Vulnerability on Avatar Upload

humansignal/label-studio · GHSA-q68h-xwq5-mm7x

medium2024-01-23

Use-after-free when setting the locale

longbridgeapp/rust-i18n · GHSA-c8v3-jhv9-4ppc

critical2024-01-23

CVE-2024-23636-Remote Command Execution in SOFARPC

sofastack/sofa-rpc · GHSA-7q8p-9953-pxvr

medium2024-01-23

CVE-2023-49783-No permission checks for editing/deleting records with CSV import form

silverstripe/silverstripe-admin · GHSA-j3m6-gvm8-mhvw

critical2024-01-23

CVE-2023-49657-Cross-site Scripting in Apache superset

apache/superset · GHSA-rwhh-6x83-84v6

high2024-01-23

CVE-2024-23345-XSS potential in rendered Markdown fields (comments, description, notes, etc.)

nautobot/nautobot · GHSA-v4xv-795h-rv4h

medium2024-01-23

CVE-2023-6927-keycloak-core: open redirect via "form_post.jwt" JARM response mode

keycloak/keycloak · GHSA-9vm7-v8wj-3fqw

medium2024-01-23

CVE-2024-23339-Prototype pollution not blocked by object-path related utilities in hoolock

elijahharry/hoolock · GHSA-4c2g-hx49-7h25

medium2024-01-23

CVE-2024-23340-@hono/node-server cannot handle "double dots" in URL

honojs/node-server · GHSA-rjq5-w47x-x359