Security Advisories | GitStock

medium2023-06-06

CVE-2023-33958-Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack

notaryproject/notation · GHSA-rvrx-rrwh-r9p6

medium2023-06-06

CVE-2023-33957-Notation vulnerable to denial of service from high number of artifact signatures

notaryproject/notation · GHSA-9m3v-v4r5-ppx7

medium2023-06-06

CVE-2023-32683-Synapse has URL deny list bypass via oEmbed and image URLs when generating previews

matrix-org/synapse · GHSA-98px-6486-j7qc

medium2023-06-06

CVE-2023-32682-Synapse has improper checks for deactivated users during login

matrix-org/synapse · GHSA-26c5-ppr8-f33p

medium2023-06-06

CVE-2022-46165-syncthing vulnerable to Cross-site Scripting (XSS) in Web GUI

syncthing/syncthing · GHSA-9rp6-23gf-4c3h

high2023-06-06

CVE-2023-34103-avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

avo-hq/avo · GHSA-5cr9-5jx3-2g39

medium2023-06-06

trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets

bluejekyll/trust-dns · GHSA-5fm9-h728-fwpj

high2023-06-06

CVE-2023-34092-Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

vitejs/vite · GHSA-353f-5xf4-qw67

critical2023-06-06

CVE-2023-22647-Rancher vulnerable to Privilege Escalation via manipulation of Secrets

rancher/rancher · GHSA-p976-h52c-26p6

medium2023-06-06

CVE-2022-43760-Rancher UI has multiple Cross-Site Scripting (XSS) issues

rancher/rancher · GHSA-46v3-ggjg-qq3x

high2023-06-06

CVE-2020-10676-Rancher users retain access after moving namespaces into projects they don't have access to

rancher/rancher · GHSA-8vhc-hwhc-cpj4

medium2023-06-06

CVE-2023-2984-Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter

pimcore/pimcore · GHSA-46g3-f9r8-xj4v

high2023-06-06

CVE-2023-7332-PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash

pmmp/pocketmine-mp · GHSA-h87r-f4vc-mchv

high2023-06-06

PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency

pmmp/pocketmine-mp · GHSA-pqp3-8rrw-g8vm

medium2023-06-06

CVE-2023-2983-Pimcore Privilege Defined With Unsafe Actions vulnerability

pimcore/pimcore · GHSA-m4mv-rmr7-h5f5

high2023-06-06

CVE-2023-33967-SQL injection when using MySQL/PostgreSQL data checking

megaease/easeprobe · GHSA-4c32-w6c7-77x4

critical2023-06-06

CVE-2023-33965-Brook's tproxy server is vulnerable to a drive-by command injection.

txthinking/brook · GHSA-vfrj-fv6p-3cpf

medium2023-06-06

CVE-2023-33962-JStachio XSS vulnerability: Unescaped single quotes

jstachio/jstachio · GHSA-gwxv-jv83-6qjr

low2023-06-05

cheqd-node affected by Inter-blockchain Communication (IBC) protocol "Huckleberry" vulnerability

cheqd/cheqd-node · GHSA-7c94-gvvj-r3mg

medium2023-06-05

CVE-2023-3109-Admidio vulnerable to Cross-site Scripting

admidio/admidio · GHSA-gx4r-fvwg-8678