Security Advisories | GitStock

critical2023-09-21

CVE-2015-5467-Yii2 allows attackers to execute any local .php file via a relative path in the view parameter

yiisoft/yii2-framework · GHSA-7cfq-72w2-24q4

high2023-09-21

CVE-2015-8371-Composer allows cache poisoning from other projects built on the same host

composer/composer · GHSA-725m-w832-q973

high2023-09-20

CVE-2023-42443-Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

vyperlang/vyper · GHSA-c647-pxm2-c52w

high2023-09-20

CVE-2023-42439-GeoNode vulnerable to SSRF Bypass to return internal host data

geonode/geonode · GHSA-pxg5-h34r-7q8p

high2023-09-20

CVE-2023-41890-Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

sustainsys/saml2 · GHSA-fv2h-753j-9g39

high2023-09-20

CVE-2023-37279-Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

contribsys/faktory · GHSA-x4hh-vjm7-g2jv

medium2023-09-20

CVE-2023-43494-Jenkins does not exclude sensitive build variables from search

jenkinsci/jenkins · GHSA-279f-qwgh-h5mp

low2023-09-20

CVE-2023-34047-Spring for GraphQL may be exposed to GraphQL context with values from a different session

spring-projects/spring-graphql · GHSA-frqc-f2h8-fjvf

high2023-09-20

CVE-2023-4853-Quarkus HTTP vulnerable to incorrect evaluation of permissions

quarkusio/quarkus · GHSA-4f4r-wgv2-jjvg

high2023-09-20

CVE-2023-43619-Croc sender may send dangerous new files to receiver

schollz/croc · GHSA-ppjh-xp5v-46wc

medium2023-09-20

CVE-2023-43617-Cros secrets may be disclosed to untrusted relay

schollz/croc · GHSA-hp56-xvf4-g6wr

medium2023-09-20

CVE-2023-26144-graphql Uncontrolled Resource Consumption vulnerability

graphql/graphql-js · GHSA-9pv7-vfvm-6vr7

medium2023-09-20

CVE-2023-43616-Sender can cause a receiver to overwrite files during ZIP extraction in Croc

schollz/croc · GHSA-8c8w-f7wp-2jr2

medium2023-09-20

CVE-2023-43618-Croc requires senders to provide local IP addresses in cleartext

schollz/croc · GHSA-7mp6-929p-pqhj

medium2023-09-20

CVE-2023-43621-Croc may expose secret to local users

schollz/croc · GHSA-7g3v-4ggr-xvjf

high2023-09-20

CVE-2023-43620-Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device

schollz/croc · GHSA-364c-vvqx-446c

high2023-09-20

CVE-2023-38887-File Upload vulnerability in Dolibarr ERP CRM

dolibarr/dolibarr · GHSA-g8h7-mcp6-pf47

high2023-09-20

CVE-2023-38886-Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script

dolibarr/dolibarr · GHSA-6773-rfjv-c54w

critical2023-09-20

CVE-2023-38888-Cross Site Scripting vulnerability in Dolibarr ERP CRM

dolibarr/dolibarr · GHSA-62wf-h26v-5m57

critical2023-09-19

CVE-2022-24816-Improper Control of Generation of Code ('Code Injection') in jai-ext

geosolutions-it/jai-ext · GHSA-v92f-jx6p-73rx