Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories

Loading...
High
GSA_kwCzR0hTQS1tYzUyLWpwbTItY3FoNs4AAxFx
Deno is vulnerable to race condition via interactive permission prompt spoofing
Ecosystems: cargo
Packages: deno
Source: GitHub Advisory Database
Published: 4 months ago
High
GSA_kwCzR0hTQS14M21oLWp2anctM3h3eM0zKw
openssl-src's infinite loop in `BN_mod_sqrt()` reachable when parsing certificates
Ecosystems: cargo
Packages: openssl-src
Source: GitHub Advisory Database
Published: about 1 year ago
Moderate
GSA_kwCzR0hTQS1wNTJnLWNtNWotbWp2NM4AAxfu
openssl-src subject to Timing Oracle in RSA Decryption
Ecosystems: cargo
Packages: openssl-src
Source: GitHub Advisory Database
Published: 4 months ago
High
GSA_kwCzR0hTQS1xOXdqLWY0cXctNnZmas4AApp0
Read buffer overruns processing ASN.1 strings
Ecosystems: cargo
Packages: openssl-src
Source: GitHub Advisory Database
Published: about 1 year ago
High
GSA_kwCzR0hTQS0zNjM3LXY2dnEteHFxd84AAu1x
Harbor fails to validate the user permissions when updating tag retention policies
Ecosystems: go
Packages: github.com/goharbor/harbor
Source: GitHub Advisory Database
Published: 9 months ago
Moderate
GSA_kwCzR0hTQS04YzZwLXY4MzctNzdmNs4AAu1z
Harbor fails to validate the user permissions when updating tag immutability policies
Ecosystems: go
Packages: github.com/goharbor/harbor
Source: GitHub Advisory Database
Published: 9 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZ4cGctZ2c5Zy03Nmdq
Moderate severity vulnerability that affects django
Ecosystems: pypi
Packages: django
Source: GitHub Advisory Database
Published: almost 5 years ago
Moderate
GSA_kwCzR0hTQS01Mjg2LWYycmYtMzVjMs4AAygz
Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
Ecosystems: pypi
Packages: wagtail
Source: GitHub Advisory Database
Published: 2 months ago
Moderate
GSA_kwCzR0hTQS1wcmptLTJmajItNzg3Zs4AAyQo
Moodle may allow teachers to access the names of users they could not otherwise access
Ecosystems: packagist
Packages: moodle/moodle
Source: GitHub Advisory Database
Published: 2 months ago
Critical
GSA_kwCzR0hTQS1mMnJqLW00MnItNmptMs4AAvil
Skipper vulnerable to SSRF via X-Skipper-Proxy
Ecosystems: go
Packages: github.com/zalando/skipper
Source: GitHub Advisory Database
Published: 7 months ago
Critical
GSA_kwCzR0hTQS1mZmY4LTR3OXAtN3Y3Ns4AAbau
Command Injection in Pygments
Ecosystems: pypi
Packages: Pygments
Source: GitHub Advisory Database
Published: about 1 year ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNyNWotOTUzai14dzVw
Arbitrary execution of code in Nokogiri
Ecosystems: rubygems
Packages: rexical, nokogiri
Source: GitHub Advisory Database
Published: almost 4 years ago
Moderate
GSA_kwCzR0hTQS1jcW1yLXJjcHItY3hoM84AAiwJ
Ansible password prompts could expose passwords
Ecosystems: pypi
Packages: ansible
Source: GitHub Advisory Database
Published: about 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM5cnYtM2ptcS01Mjd3
Unexpected panic when decoding tokens in branca
Ecosystems: cargo
Packages: branca
Source: GitHub Advisory Database
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS00MzZnLTJmOTItY3ZoaM4AAygC
Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled
Ecosystems: maven
Packages: org.jenkins-ci.plugins:role-strategy
Source: GitHub Advisory Database
Published: 2 months ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNnangtbXdweC00N2p2
Private Data Disclosure in express-restify-mongoose
Ecosystems: npm
Packages: express-restify-mongoose
Source: GitHub Advisory Database
Published: over 4 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJ3eHAtaHd3Zi02NTN2
Insecure template handling in express-hbs
Ecosystems: npm
Packages: express-hbs
Source: GitHub Advisory Database
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS12ZnZqLTNtM2ctbTUzMs4AAyE3
fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime
Ecosystems: go
Packages: github.com/crossplane/crossplane-runtime
Source: GitHub Advisory Database
Published: 3 months ago
High
GSA_kwCzR0hTQS0yMzJwLXZ3ZmYtODZtcM4AAyiv
Docker Swarm encrypted overlay network may be unauthenticated
Ecosystems: go
Packages: github.com/docker/docker
Source: GitHub Advisory Database
Published: about 2 months ago
High
GSA_kwCzR0hTQS01cDc1LXZjNWctOHJ2Ms4AAyiw
SvelteKit vulnerable to Cross-Site Request Forgery
Ecosystems: npm
Packages: @sveltejs/kit
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS01cDg0LW1taDktcHhncs4AAyhy
Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter
Ecosystems: npm
Packages: editor.md
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS13OTc0LXJxOXgtbWgzds4AAyhu
Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter
Ecosystems: npm
Packages: editor.md
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS1oeDhwLTltNDgtZzc2cs4AAyiO
Ming-Soft MCMS vulnerable to SQL injection
Ecosystems: maven
Packages: net.mingsoft:ms-mcms
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS1qcHhqLTJqdmctNmp2Oc4AAxsJ
Data Amplification in HashiCorp go-getter
Ecosystems: go
Packages: github.com/hashicorp/go-getter/v2, github.com/hashicorp/go-getter
Source: GitHub Advisory Database
Published: 4 months ago
Critical
GSA_kwCzR0hTQS1qZmg4LWMyanAtNXYzcc0asw
Remote code injection in Log4j
Ecosystems: maven
Packages: org.apache.logging.log4j:log4j-core
Source: GitHub Advisory Database
Published: over 1 year ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWd2NzMtOW13di1md2dx
Out of bounds write in prost
Ecosystems: cargo
Packages: prost
Source: GitHub Advisory Database
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdyZ20tcHBoNS1qNWg3
Exposure of Sensitive Information to an Unauthorized Actor in ansible
Ecosystems: pypi
Packages: ansible
Source: GitHub Advisory Database
Published: almost 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1xNmMtZmg5Ny00Z3d2
Denial of Service vulnerability with large JSON payloads in fastify
Ecosystems: npm
Packages: fastify
Source: GitHub Advisory Database
Published: almost 5 years ago
Moderate
GSA_kwCzR0hTQS02Z2MzLWNycDctMjV3Nc4AAx6h
gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb
Ecosystems: go
Packages: github.com/russellhaering/gosaml2
Source: GitHub Advisory Database
Published: 3 months ago
Moderate
GSA_kwCzR0hTQS1jNGpyLXZqbTQtMjdocc4AAyZE
Veracode Scan Jenkins Plugin vulnerable to information disclosure
Ecosystems: maven
Packages: com.veracode.jenkins:veracode-scan
Source: GitHub Advisory Database
Published: 2 months ago
Critical
GSA_kwCzR0hTQS1mcHJwLXA4NjktdzZxMs4AAyjJ
LangChain vulnerable to code injection
Ecosystems: pypi
Packages: langchain
Source: GitHub Advisory Database
Published: about 2 months ago
High
GSA_kwCzR0hTQS1mNnhwLTU5anEtcjM1Y84AAyiT
Phachon mm-wiki Cross Site Request Forgery vulnerability
Ecosystems: go
Packages: github.com/phachon/mm-wiki
Source: GitHub Advisory Database
Published: about 2 months ago
High
GSA_kwCzR0hTQS1nd2o1LXdwNnItNXE5Zs4AAt8B
Cronos vulnerable to DoS through unintended Contract Selfdestruct
Ecosystems: go
Packages: github.com/crypto-org-chain/cronos
Source: GitHub Advisory Database
Published: 10 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWd2ZzctcHA4Mi1jZmYz
Cross-Site Scripting in c3
Ecosystems: npm
Packages: c3
Source: GitHub Advisory Database
Published: almost 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg5eDItNXJtNy14NGdt
Insecure Comparison in secure-compare
Ecosystems: npm
Packages: secure-compare
Source: GitHub Advisory Database
Published: almost 4 years ago
High
GSA_kwCzR0hTQS1oY3BqLXFwNTUtZ2ZwaM4AAwKi
GitPython vulnerable to Remote Code Execution due to improper user input validation
Ecosystems: pypi
Packages: GitPython
Source: GitHub Advisory Database
Published: 6 months ago
High
GSA_kwCzR0hTQS1qamM1LWZwN3AtNmY4d84AAtaD
Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD
Ecosystems: npm
Packages: shescape
Source: GitHub Advisory Database
Published: 11 months ago
Moderate
GSA_kwCzR0hTQS1qNTg2LWNqNjctdmc0cM0rQg
Cross-Site Request Forgery in Drupal core
Ecosystems: packagist
Packages: drupal/core
Source: GitHub Advisory Database
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS1qMjhyLWo1NG0tZ3BjNM0WJA
Code Injection in SLO Generator
Ecosystems: pypi
Packages: slo-generator
Source: GitHub Advisory Database
Published: over 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhxYzgtajg2eC0yNzY0
Off-by-one error in simple-slab
Ecosystems: cargo
Packages: simple-slab
Source: GitHub Advisory Database
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS04amhoLTNqZjItcGZ3cs4AAyez
Mattermost vulnerable to information disclosure
Ecosystems: go
Packages: github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost-server/v5, github.com/mattermost/mattermost-server
Source: GitHub Advisory Database
Published: 2 months ago
Moderate
GSA_kwCzR0hTQS02M2YyLTY5NTktMnB4as4AAye3
Mattermost vulnerable to cross-site scripting (XSS)
Ecosystems: go
Packages: github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost-server/v5, github.com/mattermost/mattermost-server
Source: GitHub Advisory Database
Published: 2 months ago
Moderate
GSA_kwCzR0hTQS0zd3E1LTNmNTYtdjV4Y84AAyex
Mattermost vulnerable to information disclosure
Ecosystems: go
Packages: github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v6
Source: GitHub Advisory Database
Published: 2 months ago
High
GSA_kwCzR0hTQS1oNGM5LXJyNW0tMzJmbc4AAyfx
RuoYi vulnerable to arbitrary file download
Ecosystems: maven
Packages: com.ruoyi:ruoyi
Source: GitHub Advisory Database
Published: 2 months ago
Moderate
GSA_kwCzR0hTQS1mN3JwLXh4NjctNHBqOc4AAyiW
Phachon mm-wiki vulnerable to stored cross-site scripting (XSS)
Ecosystems: go
Packages: github.com/phachon/mm-wiki
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS1qdjg1LW1xeGotM2Y5as4AAwRp
Sentry vulnerable to invite code reuse via cookie manipulation
Ecosystems: pypi
Packages: sentry
Source: GitHub Advisory Database
Published: 6 months ago
High
GSA_kwCzR0hTQS1tOHI0LWM3am0tdzc4Ms4AAmvY
Jenkins Plugin Installation Manager Tool did not verify plugin downloads
Ecosystems: maven
Packages: io.jenkins.plugin-management:plugin-management-parent-pom
Source: GitHub Advisory Database
Published: about 1 year ago
Moderate
GSA_kwCzR0hTQS1tODM2LWd4d3EtajJwbc0WvQ
Improper Access Control in github.com/treeverse/lakefs
Ecosystems: go
Packages: github.com/treeverse/lakefs
Source: GitHub Advisory Database
Published: over 1 year ago
High
GSA_kwCzR0hTQS13NTczLTRoZzctN3dncc4AAwD1
decode-uri-component vulnerable to Denial of Service (DoS)
Ecosystems: npm
Packages: decode-uri-component
Source: GitHub Advisory Database
Published: 6 months ago
Moderate
GSA_kwCzR0hTQS1xN3J2LTZocDMtdmg5Ns01tQ
Improper Input Validation in guzzlehttp/psr7
Ecosystems: packagist
Packages: guzzlehttp/psr7
Source: GitHub Advisory Database
Published: about 1 year ago
Moderate
GSA_kwCzR0hTQS1taGdtLTUydmctcHZ2Y84AAxqk
Privilege escalation in Strongbox
Ecosystems: maven
Packages: com.schibsted.security:strongbox-sdk
Source: GitHub Advisory Database
Published: 4 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFodjktNzI4ci02anFn
ReDoS via long string of semicolons in tough-cookie
Ecosystems: npm
Packages: tough-cookie
Source: GitHub Advisory Database
Published: over 4 years ago
High
GSA_kwCzR0hTQS1jeHc3LTg1eG0tM3hyY84AAePN
Plone Code Injection vulnerability
Ecosystems: pypi
Packages: Plone
Source: GitHub Advisory Database
Published: about 1 year ago
Low
GSA_kwCzR0hTQS14Mnh3LWh3OGctNjc3M84AAyrS
govuk_tech_docs vulnerable to unescaped HTML on search results page
Ecosystems: rubygems
Packages: govuk_tech_docs
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS03OXhmLTY3cjQtcTJqas4AAyqY
safe-eval vulnerable to Sandbox Bypass due to improper input sanitization
Ecosystems: npm
Packages: safe-eval
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS1oY2czLTU2amYteDR2aM4AAyqc
safe-eval vulnerable to Prototype Pollution via the safeEval function
Ecosystems: npm
Packages: safe-eval
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS00OHdwLXA5cXYtNGo2NM4AAytp
Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service
Ecosystems: rubygems
Packages: commonmarker
Source: GitHub Advisory Database
Published: about 2 months ago
High
GSA_kwCzR0hTQS13NG0zLTQzZ3AteDhoeM4AAyto
.NET Remote Code Execution vulnerability
Ecosystems: nuget
Packages: Microsoft.NetCore.App.Runtime.win-x64, Microsoft.NetCore.App.Runtime.win-x86, Microsoft.NetCore.App.Runtime.win-arm64, Microsoft.NetCore.App.Runtime.win-arm
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS1oaDMyLTczNDQtY2cyZs4AAgbh
Authorization bypass in Spring Security
Ecosystems: maven
Packages: org.springframework.security:spring-security-core
Source: GitHub Advisory Database
Published: about 1 year ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM0cjctcTQ5Zi1oMzdj
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Ecosystems: rubygems, npm
Packages: uglifier, uglify-js
Source: GitHub Advisory Database
Published: over 5 years ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRnODgtZnBwci01M3Bw
Prototype Pollution in set-value
Ecosystems: npm
Packages: set-value
Source: GitHub Advisory Database
Published: almost 4 years ago
Low
GSA_kwCzR0hTQS12dnA3LXI0MjItcng4M84AAyu5
Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-web-templates
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS05MzM3LThjNmMtYzJ4Z84AAyt7
CubeFS allows Kubernetes cluster-level privilege escalation
Ecosystems: go
Packages: github.com/cubefs/cubefs
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS1jODg1LTg5ZnctNTVxcs4AAyu1
org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-rendering-macro-rss, org.xwiki.platform:xwiki-core-rendering-macro-rss
Source: GitHub Advisory Database
Published: about 2 months ago
High
GSA_kwCzR0hTQS1obW03LTZwaDktOGpmMs4AAyuz
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Basic Cross-site Scripting
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-livedata-macro
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS14d3BoLXg2eGotd2dnds4AAyu2
org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-oldcore
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS1wd2Z2LTNjdmctOW00Y84AAyux
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-oldcore
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS12cnI4LWZwN2MtN3FncM4AAyuu
org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-flamingo-theme-ui
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS1mNHY4LTU4ZjYtbXdqNM4AAyuw
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-flamingo-theme-ui
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS1xeDloLWM1djYtZ2hxaM4AAyut
org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-panels-ui
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS13N3Y5LWZjNDktNHFnNM4AAyuq
org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS00NjU1LXdoN3YtM3ZtZ84AAyus
org.xwiki.platform:xwiki-platform-logging-ui Eval Injection vulnerability
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-logging-ui
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS05cGMyLXg5cWYtN2oycc4AAyuo
org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro
Source: GitHub Advisory Database
Published: about 2 months ago
Critical
GSA_kwCzR0hTQS1jNWY0LXA1d3YtMjQ3Nc4AAyur
xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
Ecosystems: maven
Packages: org.xwiki.platform:xwiki-platform-panels-ui
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS1mMjQ0LWY5ZmMtdzZmcc4AAyuX
Jenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentials
Ecosystems: maven
Packages: io.jenkins.plugins:thycotic-devops-secrets-vault
Source: GitHub Advisory Database
Published: about 2 months ago
High
GSA_kwCzR0hTQS0yajc5LThwcWMtcjd4Ns4AAvJg
react-native-reanimated vulnerable to ReDoS
Ecosystems: npm
Packages: react-native-reanimated
Source: GitHub Advisory Database
Published: 8 months ago
Moderate
GSA_kwCzR0hTQS0zOGpjLTJyd3gtcWd4cs4AAyuT
Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation
Ecosystems: maven
Packages: org.jenkins-ci.plugins:image-tag-parameter
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS00Njk3LTNnOTItZ2g3OM4AAyuV
Jenkins Thycotic Secret Server Plugin missing permissions check
Ecosystems: maven
Packages: io.jenkins.plugins:thycotic-secret-server
Source: GitHub Advisory Database
Published: about 2 months ago
Moderate
GSA_kwCzR0hTQS1naDV3LWdmZmgtNjhwcs4AAyug
Jenkins Lucene-Search Plugin vulnerable to Cross-Site Request Forgery
Ecosystems: maven
Packages: org.jenkins-ci.plugins:lucene-search
Source: GitHub Advisory Database
Published: about 2 months ago
High
GSA_kwCzR0hTQS01cG0yLTltcjItM2Zycc4AAxCb
Component takeover in Oracle Data Provider for .NET
Ecosystems: nuget
Packages: Oracle.ManagedDataAccess.Core, Oracle.ManagedDataAccess
Source: GitHub Advisory Database
Published: 5 months ago
Critical
GSA_kwCzR0hTQS1wZmNjLTNnNnItOHJnOM4AAxyW
Undertow client not checking server identity presented by server certificate in https connections
Ecosystems: maven
Packages: io.undertow:undertow-core
Source: GitHub Advisory Database
Published: 3 months ago
Low
GSA_kwCzR0hTQS1wbWpnLTUyaDktNzJxds4AAtUK
Argo CD SSO users vulnerable to Cross-site Scripting
Ecosystems: go
Packages: github.com/argoproj/argo-cd
Source: GitHub Advisory Database
Published: 11 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBmM3AteDZxai02ajdx
mio invalidly assumes the memory layout of std::net::SocketAddr
Ecosystems: cargo
Packages: mio
Source: GitHub Advisory Database
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBoNTgtNHZyai13Nmhy
bootstrap Cross-site Scripting vulnerability
Ecosystems: npm
Packages: bootstrap
Source: GitHub Advisory Database
Published: over 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU2MmMtNXI5NC14aDk3
The Pallets Project in flask that can result in large amount of memory usage
Ecosystems: pypi
Packages: flask
Source: GitHub Advisory Database
Published: almost 5 years ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1tNjItd3hjOC1jZjdt
Code Execution Through IIFE in serialize-to-js
Ecosystems: npm
Packages: serialize-to-js
Source: GitHub Advisory Database
Published: almost 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA0cGotOWc1OS00cHB2
Remote Code Execution in SyliusResourceBundle
Ecosystems: packagist
Packages: sylius/resource-bundle
Source: GitHub Advisory Database
Published: almost 3 years ago
Moderate
GSA_kwCzR0hTQS1td2dqLTd4N2otNjk2Ns0Vuw
Deserialization of Untrusted Data in ParlAI
Ecosystems: pypi
Packages: parlai
Source: GitHub Advisory Database
Published: over 1 year ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1tN3YtdnB2OC14ZmMz
Double free in smallvec
Ecosystems: cargo
Packages: smallvec
Source: GitHub Advisory Database
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1mNGc2LWM0N3gtcWh3d84AAyv6
Microweber vulnerable to cross-site scripting (XSS)
Ecosystems: packagist
Packages: microweber/microweber
Source: GitHub Advisory Database
Published: about 2 months ago
High
GSA_kwCzR0hTQS1jbTQzLWYycHYtNnY2OM4AAwAB
OS Command Injection in Apache Airflow
Ecosystems: pypi
Packages: apache-airflow-providers-apache-hive
Source: GitHub Advisory Database
Published: 6 months ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhmZzUteHB2dy1jOXg0
Improper Input Validation in Apache Camel
Ecosystems: maven
Packages: org.apache.camel:camel-management, org.apache.camel:camel-core, org.apache.camel:camel
Source: GitHub Advisory Database
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS0ycDloLWNjdzctMzNnZs4AAvz0
cleo is vulnerable to Regular Expression Denial of Service (ReDoS)
Ecosystems: pypi
Packages: cleo
Source: GitHub Advisory Database
Published: 7 months ago
Moderate
GSA_kwCzR0hTQS00MjYyLXdyN3AtZ3Bjas3tmg
Rundeck Community Edition vulnerable to Cross-site Scripting
Ecosystems: maven
Packages: org.rundeck:rundeck
Source: GitHub Advisory Database
Published: about 1 year ago
Moderate
GSA_kwCzR0hTQS0zZ2ZqLWZ4eDQtZjIyd84AAvv1
OpenFGA Authorization Bypass
Ecosystems: go
Packages: github.com/openfga/openfga
Source: GitHub Advisory Database
Published: 7 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTMyaHctM3B2aC12Y3Zj
XSS vulnerability on password reset page
Ecosystems: packagist
Packages: mautic/core
Source: GitHub Advisory Database
Published: almost 2 years ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM3amotd3A3Zy03d2o0
Read of uninitialized memory in cdr
Ecosystems: cargo
Packages: cdr
Source: GitHub Advisory Database
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNjNjctZ2M0OC05ODN3
Path Traversal in Ansible
Ecosystems: pypi
Packages: ansible
Source: GitHub Advisory Database
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM2M2gtdmo2cS0zY21q
Rosetta-Flash JSONP Vulnerability in hapi
Ecosystems: npm
Packages: hapi
Source: GitHub Advisory Database
Published: almost 3 years ago
Low
GSA_kwCzR0hTQS1xOWhtLWhyODktaGdtN84AAyuh
Jenkins WSO2 Oauth Plugin does not mask the WSO2 Oauth client secret on the global configuration form
Ecosystems: maven
Packages: org.jenkins-ci.plugins:wso2id-oauth
Source: GitHub Advisory Database
Published: about 2 months ago
Filter by Package
tensorflow 433 tensorflow-cpu 387 tensorflow-gpu 384 org.jenkins-ci.main:jenkins-core 163 pimcore/pimcore 98 org.apache.tomcat:tomcat 78 microweber/microweber 75 com.fasterxml.jackson.core:jackson-databind 69 Microsoft.ChakraCore 67 actionpack 57 github.com/usememos/memos 55 thorsten/phpmyfaq 53 moodle/moodle 53 apache-airflow 45 ansible 44 org.apache.struts:struts2-core 43 django 42 shopware/platform 41 rdiffweb 40 typo3/cms-core 39 Pillow 39 org.keycloak:keycloak-core 39 com.thoughtworks.xstream:xstream 37 showdoc/showdoc 36 shopware/core 32 librenms/librenms 31 opencv-contrib-python 30 opencv-python 30 snipe/snipe-it 29 github.com/answerdev/answer 29 nokogiri 28 org.apache.nifi:nifi 28 concrete5/concrete5 27 org.springframework:spring-core 27 io.undertow:undertow-core 26 Plone 26 openssl-src 26 com.liferay.portal:release.portal.bom 25 rubygems-update 25 net.mingsoft:ms-mcms 25 activerecord 24 craftcms/cms 24 parse-server 24 org.elasticsearch:elasticsearch 23 matrix-synapse 23 dolibarr/dolibarr 22 org.xwiki.platform:xwiki-platform-oldcore 22 apache-superset 22 org.apache.tomcat.embed:tomcat-embed-core 22 gogs.io/gogs 22 remdex/livehelperchat 22 org.jenkins-ci.plugins:script-security 21 org.apache.solr:solr-core 21 org.springframework.security:spring-security-core 21 org.eclipse.jetty:jetty-server 21 rack 20 org.apache.openmeetings:openmeetings-parent 20 typo3/cms 19 electron 19 froxlor/froxlor 19 github.com/argoproj/argo-cd 19 com.vaadin:vaadin-bom 19 github.com/hashicorp/nomad 18 org.keycloak:keycloak-parent 18 mautic/core 18 shopware/shopware 18 silverstripe/framework 18 baserproject/basercms 17 org.bouncycastle:bcprov-jdk14 17 sequelize 17 cakephp/cakephp 17 org.apache.activemq:activemq-client 17 @openzeppelin/contracts-upgradeable 16 marked 16 org.bouncycastle:bcprov-jdk15 16 org.apache.geode:geode-core 16 pocketmine/pocketmine-mp 16 yetiforce/yetiforce-crm 16 vyper 16 drupal/core 16 rusqlite 16 @openzeppelin/contracts 15 grumpydictator/firefly-iii 15 Django 15 github.com/ethereum/go-ethereum 15 org.apache.jspwiki:jspwiki-main 15 francoisjacquet/rosariosis 15 org.apache.cxf:cxf 14 swagger-ui 14 symfony/symfony 14 strapi 14 org.apache.dubbo:dubbo 14 wasmtime 13 helm.sh/helm/v3 13 tribalsystems/zenario 13 notebook 13 Microsoft.AspNetCore.App.Runtime.linux-x64 13 Microsoft.AspNetCore.App.Runtime.osx-x64 13 puppet 13 Microsoft.AspNetCore.App.Runtime.win-arm 13 Microsoft.AspNetCore.App.Runtime.win-x64 13 Microsoft.AspNetCore.App.Runtime.win-x86 13 Microsoft.AspNetCore.App.Runtime.linux-arm64 13 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 13 Microsoft.AspNetCore.App.Runtime.linux-arm 13 handlebars 13 github.com/hashicorp/vault 13 github.com/rancher/rancher 13 k8s.io/kubernetes 13 publify_core 13 pyftpdlib 13 nova 13 github.com/goharbor/harbor 13 github.com/argoproj/argo-cd/v2 12 github.com/docker/docker 12 rails-html-sanitizer 12 ezsystems/ezpublish-kernel 12 golang.org/x/net 12 phpmailer/phpmailer 12 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 12 ckb 12 getkirby/cms 12 forkcms/forkcms 12 openmage/magento-lts 12 next 12 actionview 12 activesupport 12 rails 12 getgrav/grav 12 org.apache.tika:tika-core 12 onionshare-cli 11 org.jenkins-ci.plugins.workflow:workflow-cps 11 feehi/feehicms 11 org.jenkins-ci.plugins:git 11 github.com/containerd/containerd 11 org.apache.cxf:cxf-core 11 org.apache.hadoop:hadoop-common 11 org.apache.hadoop:hadoop-main 11 github.com/opencontainers/runc 11 intelliants/subrion 11 modoboa 11 fat_free_crm 11 calibreweb 11 org.apache.jspwiki:jspwiki-war 11 github.com/mattermost/mattermost-server/v6 11 nilsteampassnet/teampass 11 DotNetNuke.Core 11 prestashop/prestashop 10 github.com/cilium/cilium 10 org.apache.camel:camel-core 10 vm2 10 ghost 10 github.com/hashicorp/consul 10 com.vaadin:flow-server 10 Microsoft.AspNetCore.App.Runtime.win-arm64 10 Microsoft.NETCore.App 10 Microsoft.AspNetCore.All 10 twisted 10 org.xwiki.platform:xwiki-platform-web 10 contao/core-bundle 10 angular 10 ckeditor4 10 october/system 10 tinymce 10 org.apache.ranger:ranger 10 org.xwiki.platform:xwiki-platform-web-templates 9 opencv-contrib-python-headless 9 opencv-python-headless 9 centreon/centreon 9 org.apache.xmlgraphics:batik 9 io.jenkins:configuration-as-code 9 code.gitea.io/gitea 9 org.apache.hive:hive 9 directus 9 concrete5/core 9 org.jenkins-ci.plugins.workflow:workflow-cps-global-lib 9 passenger 9 jquery 9 waitress 9 kevinpapst/kimai2 9 cobbler 9 puma 9 validator 9 serve 9 org.jenkins-ci.plugins:email-ext 8 ssddanbrown/bookstack 8 ezsystems/ezplatform-kernel 8 funadmin/funadmin 8 github.com/traefik/traefik/v2 8 org.apache.tapestry:tapestry-core 8 Microsoft.AspNetCore.App.Runtime.linux-musl-arm 8 Microsoft.AspNetCore.App 8 OctoPrint 8 alextselegidis/easyappointments 8 codeigniter4/framework 8 nodebb 8 url-parse 8 matrix-js-sdk 8 urijs 8 steal 8 topthink/framework 8 jquery-ui 8 deno 8 pyload-ng 8 sylius/sylius 8 org.apache.shiro:shiro-core 8 org.apache.poi:poi 8 org.apache.tika:tika 8 next-auth 8 org.yaml:snakeyaml 8 org.apache.commons:commons-compress 8 github.com/kubeedge/kubeedge 8 npm 8 org.apache.karaf:apache-karaf 8 mysql:mysql-connector-java 8 wwbn/avideo 8 org.jboss.resteasy:resteasy-client 8 org.apache.pdfbox:pdfbox 8 elefant/cms 8 facturascripts/facturascripts 8 impresscms/impresscms 8 org.keycloak:keycloak-services 8 org.apache.hive:hive-exec 8 node-forge 8 github.com/nats-io/nats-server/v2 8 glance 8 org.apache.kylin:kylin 8 org.apache.ozone:ozone-main 8 editor.md 8 github.com/pomerium/pomerium 8 wagtail 8 keystone 8 cryptography 8 org.apache.zeppelin:zeppelin 7 Flask-AppBuilder 7 org.springframework:spring-webmvc 7 com.xuxueli:xxl-job 7 org.apache.archiva:archiva 7 github.com/go-gitea/gitea 7 io.jenkins.plugins:cavisson-ns-nd-integration 7 org.opennms:opennms 7 Microsoft.NETCore.App.Runtime.linux-arm64 7 org.jenkins-ci.plugins:subversion 7 tar 7 github.com/cri-o/cri-o 7 github.com/mattermost/mattermost-server 7 total.js 7 org.igniterealtime.openfire:parent 7 pillow 7 kiwitcms 7 systeminformation 7 october/cms 7 feehi/cms 7 org.apache.atlas:atlas-common 7 org.apache.santuario:xmlsec 7 org.craftercms:crafter-studio 7 jsrsasign 7 Microsoft.NETCore.App.Runtime.linux-musl-arm64 7 org.jruby:jruby-stdlib 7 io.jenkins.blueocean:blueocean 7 Microsoft.NETCore.App.Runtime.linux-musl-x64 7 Microsoft.NETCore.App.Runtime.linux-x64 7 Microsoft.NETCore.App.Runtime.win-x64 7 Microsoft.NETCore.App.Runtime.win-x86 7 Microsoft.NETCore.App.Runtime.osx-x64 7 Microsoft.NETCore.App.Runtime.win-arm64 7 Microsoft.NETCore.App.Runtime.win-arm 7 Microsoft.NETCore.App.Runtime.linux-arm 7 org.postgresql:postgresql 7 org.apache.logging.log4j:log4j-core 7 pysaml2 7 com.jflyfox:jflyfox_jfinal 7 golang.org/x/crypto 7 laravel/framework 7 OPCFoundation.NetStandard.Opc.Ua.Core 7 october/backend 7 numpy 7 keystone 7 snyk-broker 7 hapi 7 org.apache.httpcomponents:httpclient 7 org.apache.druid:druid 7 bootstrap 7 urllib3 7 hermes-engine 7 hyper 7 org.apache.spark:spark-core_2.11 7 smarty/smarty 7 org.apache.cxf:apache-cxf 7 jQuery 7 mlflow 7 wallabag/wallabag 7 undici 7 lodash 7 org.apache.james:james-server 7 github.com/google/fscrypt 7 org.jeecgframework.boot:jeecg-boot-base 7 io.atomix:atomix 7 github.com/grafana/grafana 7 org.apache.hive:hive-service 7