Security Advisories | GitStock

high2023-07-20

CVE-2023-37650-Cockpit CMS Cross-Site Request Forgery vulnerability

cockpit-hq/cockpit · GHSA-45g2-r339-pjwf

medium2023-07-20

CVE-2023-37602-Alkacon OpenCMS arbitrary file upload vulnerability

alkacon/opencms-core · GHSA-ghg2-3w9x-9599

critical2023-07-20

CVE-2023-37471-OpenAM vulnerable to user impersonation using SAMLv1.x SSO process

openidentityplatform/openam · GHSA-4mh8-9wq6-rjxg

high2023-07-20

CVE-2023-37899-Feathers socket handler allows abusing implicit toString

feathersjs/feathers · GHSA-hhr9-rh25-hvf9

medium2023-07-20

CVE-2023-37276-aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser

aio-libs/aiohttp · GHSA-45c4-8wx5-qw6w

medium2023-07-20

CVE-2023-3300-Nomad Search API Leaks Information About CSI Plugins

hashicorp/nomad · GHSA-v5fm-hr72-27hx

medium2023-07-20

CVE-2023-3072-Nomad ACL Policies without Label are Applied to Unexpected Resources

hashicorp/nomad · GHSA-rpvr-38xv-xvxq

low2023-07-20

CVE-2023-3299-Nomad Caller ACL Token’s Secret ID is Exposed to Sentinel

hashicorp/nomad · GHSA-9jfx-84v9-2rr2

high2023-07-19

CVE-2023-37897-grav Server-side Template Injection (SSTI) mitigation bypass

getgrav/grav · GHSA-9436-3gmp-4f53

medium2023-07-19

impl `FromMdbValue` for bool is unsound

vhbit/lmdb-rs · GHSA-f9g6-fp84-fv92

high2023-07-19

CVE-2023-33265-Hazelcast Executor Services don't check client permissions properly

hazelcast/hazelcast · GHSA-c5vj-wp4v-mmvx

medium2023-07-19

CVE-2023-3674-keylime fails to flag device as untrusted when signature does not validate

keylime/keylime · GHSA-g4wg-cfpf-9689

medium2023-07-19

CVE-2022-40896-Pygments vulnerable to ReDoS

pygments/pygments · GHSA-mrwq-x4v8-fh7p

high2023-07-19

CVE-2023-28754-Apache ShardingSphere-Agent Deserialization of Untrusted Data vulnerability

apache/shardingsphere · GHSA-3cxh-xp3g-jxjm

critical2023-07-19

CVE-2023-3765-MLflow Path Traversal vulnerability

mlflow/mlflow · GHSA-fmxj-6h9g-6vw3

high2023-07-18

CVE-2023-37788-goproxy Denial of Service vulnerability

elazarl/goproxy · GHSA-4r8x-2p26-976p

low2023-07-18

CVE-2023-37481-Fides Webserver Vulnerable to SVG Bomb File Uploads

ethyca/fides · GHSA-3rw2-wfc8-wmj5

low2023-07-18

CVE-2023-37480-Fides Webserver Vulnerable to Zip Bomb File Uploads

ethyca/fides · GHSA-g95c-2jgm-hqc6

medium2023-07-18

CVE-2023-0105-Keycloak: Impersonation and lockout possible through incorrect handling of email trust

keycloak/keycloak · GHSA-c7xw-p58w-h6fj

high2023-07-18

CVE-2023-37477-1Panel command injection vulnerability in Firewall ip functionality

1panel-dev/1panel · GHSA-p9xf-74xh-mhw5