Open Source Vulnerabilities

mangadex-downloader

mangadex-downloader vulnerable to unauthorized file reading

jose, jose-browser-runtime, jose-node-cjs-runtime, jose-node-esm-runtime, jose, jose, jose, jose-browser-runtime, jose-node-cjs-runtime, jose-node-esm-runtime

JOSE vulnerable to resource exhaustion via specifically crafted JWE

cruddl, cruddl

cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch

github.com/open-policy-agent/opa

OPA Compiler: Bypass of WithUnsafeBuiltins using "with" keyword to mock functions

linked_list_allocator

linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

org.xwiki.platform:xwiki-platform-oldcore, org.xwiki.platform:xwiki-platform-oldcore

XWiki Platform Improper Authorization check for inactive users

org.xwiki.platform:xwiki-platform-web-templates, org.xwiki.platform:xwiki-platform-web

XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor

org.xwiki.platform:xwiki-platform-index-ui, org.xwiki.platform:xwiki-platform-index-ui

XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list

org.xwiki.platform:xwiki-platform-attachment-ui

XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

org.xwiki.platform:xwiki-platform-mentions-ui, org.xwiki.platform:xwiki-platform-mentions-ui

XWiki Platform Mentions UI vulnerable to Cross-site Scripting

org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki, org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki

XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

org.xwiki.platform:xwiki-platform-tag-ui, org.xwiki.platform.applications:xwiki-application-tag, org.xwiki.platform:xwiki-platform-tag-ui

XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

github.com/talos-systems/talos

Talos worker join token can be used to get elevated access level to the Talos API