Security advisories

critical2024-01-12

CVE-2024-22206-@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

clerk/javascript · GHSA-q6w5-jg5q-47vg

medium2024-01-12

Minor fix to previous patch for CVE-2022-35918

streamlit/streamlit · GHSA-8qw9-gf7w-42x5

medium2024-01-12

CVE-2024-23173-MediaWiki Cargo Extension Cross-site Scripting vulnerability

wikimedia/mediawiki-extensions-cargo · GHSA-rhpm-63w5-79rg

high2024-01-12

CVE-2016-20021-Gentoo Portage missing PGP validation of executed code

gentoo/portage · GHSA-pw5x-x5jw-ccmh

critical2024-01-11

CVE-2024-22199-Django Template Engine Vulnerable to XSS

gofiber/template · GHSA-4mq2-gc4j-cmw6

high2024-01-11

CVE-2024-22198-Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

0xjacky/nginx-ui · GHSA-8r25-68wm-jw35

high2024-01-11

CVE-2024-22197-Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)

0xjacky/nginx-ui · GHSA-pxmr-q2x3-9x9m

high2024-01-11

CVE-2024-22196-Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

0xjacky/nginx-ui · GHSA-h374-mm57-879c

critical2024-01-11

CVE-2019-6342-Drupal Improper Access Control

drupal/core · GHSA-xq62-62c9-22mg

medium2024-01-11

CVE-2024-22195-Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

pallets/jinja · GHSA-h5c8-rqwp-cp95

low2024-01-11

CVE-2024-22194-cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code

cyber-domain-ontology/cdo-utility-local-uuid · GHSA-rgrf-6mf5-m882

medium2024-01-10

CVE-2023-50172-WWBN AVideo recovery notification bypass vulnerability

wwbn/avideo · GHSA-8m5f-2xvp-2c8w

critical2024-01-10

CVE-2023-49599-WWBN AVideo Insufficient Entropy vulnerbaility

wwbn/avideo · GHSA-wqcc-qf63-c2x4

high2024-01-10

CVE-2023-49810-WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability

wwbn/avideo · GHSA-v977-h4hm-rrff

high2024-01-10

CVE-2024-22190-Untrusted search path under some conditions on Windows allows arbitrary code execution

gitpython-developers/gitpython · GHSA-2mqj-m65w-jghx

critical2024-01-10

CVE-2023-49569-Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

go-git/go-git · GHSA-449p-3h89-pw88

medium2024-01-10

CVE-2023-6476-CRI-O's pods can break out of resource confinement on cgroupv2

cri-o/cri-o · GHSA-p4rx-7wvg-fwrc

medium2024-01-10

CVE-2024-21667-Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts

pimcore/customer-data-framework · GHSA-g273-wppx-82w4

medium2024-01-10

CVE-2024-21666-Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list

pimcore/customer-data-framework · GHSA-c38c-c8mh-vq68

medium2024-01-10

CVE-2024-21665-Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

pimcore/ecommerce-framework-bundle · GHSA-cx99-25hr-5jxf