Open Source Vulnerabilities

prometheus-2.53

github.com/siyuan-note/siyuan/kernel

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

org.apache.cxf.archetype:cxf-jaxrs-service, org.apache.cxf.archetype:cxf-jaxws-javafirst, org.apache.cxf.archetype:cxf-jaxws-wsdlfirst, org.apache.cxf.karaf:apache-cxf, org.apache.cxf.karaf:cxf-karaf-commands, org.apache.cxf.karaf:karaf-parent, org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests, org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests-felix, org.apache.cxf.services.sts.systests:cxf-services-sts-systests-advanced, org.apache.cxf.services.sts.systests:cxf-services-sts-systests-basic, org.apache.cxf.services.sts.systests:cxf-services-sts-systests-itests, org.apache.cxf.services.sts.systests:cxf-services-sts-systests-osgi, org.apache.cxf.services.sts:cxf-services-sts, org.apache.cxf.services.sts:cxf-services-sts-core, org.apache.cxf.services.sts:cxf-services-sts-systests, org.apache.cxf.services.ws-discovery:cxf-services-ws-discovery, org.apache.cxf.services.ws-discovery:cxf-services-ws-discovery-api, org.apache.cxf.services.ws-discovery:cxf-services-ws-discovery-service, org.apache.cxf.services.wsn:cxf-services-wsn, org.apache.cxf.services.wsn:cxf-services-wsn-api, org.apache.cxf.services.wsn:cxf-services-wsn-core, org.apache.cxf.services.wsn:cxf-services-wsn-osgi, org.apache.cxf.services.xkms:cxf-services-xkms, org.apache.cxf.services.xkms:cxf-services-xkms-client, org.apache.cxf.services.xkms:cxf-services-xkms-common, org.apache.cxf.services.xkms:cxf-services-xkms-features, org.apache.cxf.services.xkms:cxf-services-xkms-itests, org.apache.cxf.services.xkms:cxf-services-xkms-osgi, org.apache.cxf.services.xkms:cxf-services-xkms-service, org.apache.cxf.services.xkms:cxf-services-xkms-war, org.apache.cxf.services.xkms:cxf-services-xkms-x509-handlers, org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap, org.apache.cxf.services:cxf-services, org.apache.cxf.systests.wsdl_maven:cxf-systests-codegen, org.apache.cxf.systests.wsdl_maven:cxf-systests-java2ws, org.apache.cxf.systests:cxf-microprofile-tck, org.apache.cxf.systests:cxf-systests, org.apache.cxf.systests:cxf-systests-cdi, org.apache.cxf.systests:cxf-systests-cdi-base, org.apache.cxf.systests:cxf-systests-cdi-owb, org.apache.cxf.systests:cxf-systests-cdi-owb-multiple-apps, org.apache.cxf.systests:cxf-systests-cdi-owb-no-apps, org.apache.cxf.systests:cxf-systests-cdi-owb-producers, org.apache.cxf.systests:cxf-systests-cdi-weld, org.apache.cxf.systests:cxf-systests-cdi-weld-multiple-apps, org.apache.cxf.systests:cxf-systests-cdi-weld-no-apps, org.apache.cxf.systests:cxf-systests-cdi-weld-producers, org.apache.cxf.systests:cxf-systests-ci-grizzly, org.apache.cxf.systests:cxf-systests-ci-webapp, org.apache.cxf.systests:cxf-systests-container-integration, org.apache.cxf.systests:cxf-systests-databinding, org.apache.cxf.systests:cxf-systests-fork, org.apache.cxf.systests:cxf-systests-http-sci, org.apache.cxf.systests:cxf-systests-jaxrs, org.apache.cxf.systests:cxf-systests-jaxws, org.apache.cxf.systests:cxf-systests-kerberos, org.apache.cxf.systests:cxf-systests-ldap, org.apache.cxf.systests:cxf-systests-microprofile-async, org.apache.cxf.systests:cxf-systests-microprofile-jaxrs, org.apache.cxf.systests:cxf-systests-microprofile-nocdi, org.apache.cxf.systests:cxf-systests-microprofile-tracing, org.apache.cxf.systests:cxf-systests-microprofile-weld, org.apache.cxf.systests:cxf-systests-rs-security, org.apache.cxf.systests:cxf-systests-rs-sse, org.apache.cxf.systests:cxf-systests-rs-sse-base, org.apache.cxf.systests:cxf-systests-rs-sse-jetty, org.apache.cxf.systests:cxf-systests-rs-sse-tomcat, org.apache.cxf.systests:cxf-systests-rs-sse-undertow, org.apache.cxf.systests:cxf-systests-spring-boot, org.apache.cxf.systests:cxf-systests-tracing, org.apache.cxf.systests:cxf-systests-transport-hc5, org.apache.cxf.systests:cxf-systests-transport-jms, org.apache.cxf.systests:cxf-systests-transport-netty, org.apache.cxf.systests:cxf-systests-transport-undertow, org.apache.cxf.systests:cxf-systests-transports, org.apache.cxf.systests:cxf-systests-uncategorized, org.apache.cxf.systests:cxf-systests-ws-rm, org.apache.cxf.systests:cxf-systests-ws-security, org.apache.cxf.systests:cxf-systests-ws-security-examples, org.apache.cxf.systests:cxf-systests-ws-specs, org.apache.cxf.systests:cxf-wsdl-maven, org.apache.cxf:apache-cxf, org.apache.cxf:cxf, org.apache.cxf:cxf-archetypes, org.apache.cxf:cxf-bom, org.apache.cxf:cxf-bundle-compatible, org.apache.cxf:cxf-bundle-parent, org.apache.cxf:cxf-codegen-plugin, org.apache.cxf:cxf-corbatools-maven-plugin, org.apache.cxf:cxf-core, org.apache.cxf:cxf-distribution-javadoc, org.apache.cxf:cxf-distribution-manifest, org.apache.cxf:cxf-integration, org.apache.cxf:cxf-integration-cdi, org.apache.cxf:cxf-integration-jca, org.apache.cxf:cxf-integration-spring-boot, org.apache.cxf:cxf-integration-tracing-brave, org.apache.cxf:cxf-integration-tracing-opentelemetry, org.apache.cxf:cxf-integration-tracing-opentracing, org.apache.cxf:cxf-java2swagger-plugin, org.apache.cxf:cxf-java2wadl-plugin, org.apache.cxf:cxf-java2ws-plugin, org.apache.cxf:cxf-maven-plugins, org.apache.cxf:cxf-osgi, org.apache.cxf:cxf-parent, org.apache.cxf:cxf-repository, org.apache.cxf:cxf-rt, org.apache.cxf:cxf-rt-bindings, org.apache.cxf:cxf-rt-bindings-coloc, org.apache.cxf:cxf-rt-bindings-corba, org.apache.cxf:cxf-rt-bindings-soap, org.apache.cxf:cxf-rt-bindings-xml, org.apache.cxf:cxf-rt-databinding, org.apache.cxf:cxf-rt-databinding-aegis, org.apache.cxf:cxf-rt-databinding-jaxb, org.apache.cxf:cxf-rt-features, org.apache.cxf:cxf-rt-features-clustering, org.apache.cxf:cxf-rt-features-logging, org.apache.cxf:cxf-rt-features-metrics, org.apache.cxf:cxf-rt-features-throttling, org.apache.cxf:cxf-rt-frontend, org.apache.cxf:cxf-rt-frontend-jaxrs, org.apache.cxf:cxf-rt-frontend-jaxws, org.apache.cxf:cxf-rt-frontend-js, org.apache.cxf:cxf-rt-frontend-simple, org.apache.cxf:cxf-rt-javascript, org.apache.cxf:cxf-rt-javascript-tests, org.apache.cxf:cxf-rt-management, org.apache.cxf:cxf-rt-rs, org.apache.cxf:cxf-rt-rs-client, org.apache.cxf:cxf-rt-rs-extension-providers, org.apache.cxf:cxf-rt-rs-extension-reactivestreams, org.apache.cxf:cxf-rt-rs-extension-reactor, org.apache.cxf:cxf-rt-rs-extension-rx, org.apache.cxf:cxf-rt-rs-extension-rx2, org.apache.cxf:cxf-rt-rs-extension-rx3, org.apache.cxf:cxf-rt-rs-extension-search, org.apache.cxf:cxf-rt-rs-http-sci, org.apache.cxf:cxf-rt-rs-json-basic, org.apache.cxf:cxf-rt-rs-mp-client, org.apache.cxf:cxf-rt-rs-security, org.apache.cxf:cxf-rt-rs-security-cors, org.apache.cxf:cxf-rt-rs-security-http-signature, org.apache.cxf:cxf-rt-rs-security-jose, org.apache.cxf:cxf-rt-rs-security-jose-jaxrs, org.apache.cxf:cxf-rt-rs-security-jose-parent, org.apache.cxf:cxf-rt-rs-security-oauth-parent, org.apache.cxf:cxf-rt-rs-security-oauth2, org.apache.cxf:cxf-rt-rs-security-oauth2-saml, org.apache.cxf:cxf-rt-rs-security-sso-oidc, org.apache.cxf:cxf-rt-rs-security-sso-saml, org.apache.cxf:cxf-rt-rs-security-xml, org.apache.cxf:cxf-rt-rs-service-description, org.apache.cxf:cxf-rt-rs-service-description-common-openapi, org.apache.cxf:cxf-rt-rs-service-description-microprofile-openapi, org.apache.cxf:cxf-rt-rs-service-description-openapi-v3, org.apache.cxf:cxf-rt-rs-service-description-swagger, org.apache.cxf:cxf-rt-rs-service-description-swagger-ui, org.apache.cxf:cxf-rt-rs-sse, org.apache.cxf:cxf-rt-security, org.apache.cxf:cxf-rt-security-saml, org.apache.cxf:cxf-rt-transports, org.apache.cxf:cxf-rt-transports-http, org.apache.cxf:cxf-rt-transports-http-hc, org.apache.cxf:cxf-rt-transports-http-hc5, org.apache.cxf:cxf-rt-transports-http-jetty, org.apache.cxf:cxf-rt-transports-http-netty-client, org.apache.cxf:cxf-rt-transports-http-netty-server, org.apache.cxf:cxf-rt-transports-http-undertow, org.apache.cxf:cxf-rt-transports-jms, org.apache.cxf:cxf-rt-transports-local, org.apache.cxf:cxf-rt-transports-udp, org.apache.cxf:cxf-rt-transports-websocket, org.apache.cxf:cxf-rt-ws, org.apache.cxf:cxf-rt-ws-addr, org.apache.cxf:cxf-rt-ws-eventing, org.apache.cxf:cxf-rt-ws-mex, org.apache.cxf:cxf-rt-ws-policy, org.apache.cxf:cxf-rt-ws-rm, org.apache.cxf:cxf-rt-ws-security, org.apache.cxf:cxf-rt-ws-transfer, org.apache.cxf:cxf-rt-wsdl, org.apache.cxf:cxf-runtime-javascript, org.apache.cxf:cxf-servlet-compatible, org.apache.cxf:cxf-spring-boot-autoconfigure, org.apache.cxf:cxf-spring-boot-starter-jaxrs, org.apache.cxf:cxf-spring-boot-starter-jaxws, org.apache.cxf:cxf-systests-ws-transfer, org.apache.cxf:cxf-testutils, org.apache.cxf:cxf-tools, org.apache.cxf:cxf-tools-common, org.apache.cxf:cxf-tools-corba, org.apache.cxf:cxf-tools-java2ws, org.apache.cxf:cxf-tools-javato, org.apache.cxf:cxf-tools-misctools, org.apache.cxf:cxf-tools-validator, org.apache.cxf:cxf-tools-wadlto, org.apache.cxf:cxf-tools-wadlto-jaxrs, org.apache.cxf:cxf-tools-wsdlto, org.apache.cxf:cxf-tools-wsdlto-core, org.apache.cxf:cxf-tools-wsdlto-databinding-jaxb, org.apache.cxf:cxf-tools-wsdlto-frontend-javascript, org.apache.cxf:cxf-tools-wsdlto-frontend-jaxws, org.apache.cxf:cxf-tools-wsdlto-test, org.apache.cxf:cxf-wadl2java-plugin, org.apache.cxf:cxf-wsdl-validator-plugin

TuxCare security update for 206 packages (5 CVEs)

crossplane-provider-aws-dsql-fips

crossplane-provider-aws-dsql-fips

cilium-1.19, cilium-1.19

cilium-1.19, cilium-1.19

cilium-1.19, cilium-1.19

cilium-1.19, cilium-1.19

plural-sentinel-harness-0.6-fips

plural-sentinel-harness-0.6-fips

plural-sentinel-harness-0.6

plural-sentinel-harness-0.6

github.com/siyuan-note/siyuan/kernel

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

plural-agent-harness-0.6-fips

plural-agent-harness-0.6-fips

crossplane-provider-aws-lambda-fips

crossplane-provider-aws-lambda-fips

plural-agent-harness-0.6

plural-agent-harness-0.6

SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

crossplane-provider-aws-timestreamwrite-fips

crossplane-provider-aws-timestreamwrite-fips

pdfcpu-fips-0.12

pdfcpu-fips-0.12

pdfcpu-0.12

pdfcpu-0.12

paketo-buildpacks-yarn-install

paketo-buildpacks-yarn-install

github.com/siyuan-note/siyuan/kernel

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

paketo-buildpacks-yarn

paketo-buildpacks-yarn

paketo-buildpacks-vsdbg

paketo-buildpacks-vsdbg

paketo-buildpacks-spring-boot

paketo-buildpacks-spring-boot

paketo-buildpacks-sbt

paketo-buildpacks-sbt

paketo-buildpacks-python-package-managers-run

paketo-buildpacks-python-package-managers-run

paketo-buildpacks-python-package-managers-install

paketo-buildpacks-python-package-managers-install

paketo-buildpacks-poetry-install

paketo-buildpacks-poetry-install

paketo-buildpacks-poetry

paketo-buildpacks-poetry

github.com/siyuan-note/siyuan/kernel

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

paketo-buildpacks-pipenv-install

paketo-buildpacks-pipenv-install

paketo-buildpacks-pipenv