Security Advisories | GitStock

critical2024-01-17

CVE-2024-22406-Blind SQL injection in shopware

shopware/shopware · GHSA-qmp9-2xwj-m6m9

medium2024-01-16

CVE-2024-21670-CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential

hyperledger-archives/ursa · GHSA-r78f-4q2q-hvv4

medium2024-01-16

CVE-2024-22192-Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders

hyperledger-archives/ursa · GHSA-6698-mhxx-r84g

low2024-01-16

CVE-2022-31021-Breaking unlinkability in Identity Mixer using malicious keys

hyperledger-archives/ursa · GHSA-2q6j-gqc4-4gw3

medium2024-01-16

readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects

readthedocs/readthedocs-sphinx-search · GHSA-xgfm-fjx6-62mj

medium2024-01-16

CVE-2023-6395-Privilege escalation for users that can access mock configuration

xsuchy/templated-dictionary · GHSA-7j98-74jh-cjxh

medium2024-01-16

CVE-2024-22207-Default swagger-ui configuration exposes all files in the module

fastify/fastify-swagger-ui · GHSA-62jr-84gf-wmg4

high2024-01-16

CVE-2024-22191-avo vulnerable to stored cross-site scripting (XSS) in key_value field

avo-hq/avo · GHSA-ghjv-mh6x-7q6h

medium2024-01-16

CVE-2024-22362-Drupal Denial of Service vulnerability

drupal/drupal · GHSA-62cf-jvpp-48q6

high2024-01-15

CVE-2023-46226-Remote Code Execution vulnerability in Apache IoTDB via UDF

apache/iotdb · GHSA-rxgg-273w-rfw7

medium2024-01-15

CVE-2023-50290-Apache Solr allows read access to host environmet variables

apache/lucene-solr · GHSA-gg7w-pw2r-x2cq

high2024-01-13

CVE-2023-46942-EverShop vulnerable to improper authorization in GraphQL endpoints

evershopcommerce/evershop · GHSA-ggpm-9qfx-mhwg

critical2024-01-13

CVE-2023-46943-EverShop at risk to unauthorized access via weak HMAC secret

evershopcommerce/evershop · GHSA-32r3-57hp-cgfw

critical2024-01-12

CVE-2024-22206-@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

clerk/javascript · GHSA-q6w5-jg5q-47vg

medium2024-01-12

Minor fix to previous patch for CVE-2022-35918

streamlit/streamlit · GHSA-8qw9-gf7w-42x5

medium2024-01-12

CVE-2024-23173-MediaWiki Cargo Extension Cross-site Scripting vulnerability

wikimedia/mediawiki-extensions-cargo · GHSA-rhpm-63w5-79rg

high2024-01-12

CVE-2016-20021-Gentoo Portage missing PGP validation of executed code

gentoo/portage · GHSA-pw5x-x5jw-ccmh

critical2024-01-11

CVE-2024-22199-Django Template Engine Vulnerable to XSS

gofiber/template · GHSA-4mq2-gc4j-cmw6

high2024-01-11

CVE-2024-22198-Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

0xjacky/nginx-ui · GHSA-8r25-68wm-jw35

high2024-01-11

CVE-2024-22197-Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

0xjacky/nginx-ui · GHSA-pxmr-q2x3-9x9m