Open Source Vulnerabilities

libpulse-binding

Use after free in libpulse-binding

rlespinasse/github-slug-action, rlespinasse/github-slug-action

github-slug-action use of `set-env` Runner commands which are processed via stdout

ckb

Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result

ckb

Nervos CKB Snappy decompress length can be very large and causes out of memory error

ckb

Nervos CKB Panic on malformed input

libavif

UNKNOWN READ in LLVMFuzzerRunDriver

go.etcd.io/etcd/v3, go.etcd.io/etcd/v3

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only

go.etcd.io/etcd/v3, go.etcd.io/etcd/v3

Etcd embed auto compaction retention negative value causing a compaction loop or a crash

go.etcd.io/etcd/v3, go.etcd.io/etcd/v3

Etcd Gateway TLS endpoint validation only confirms TCP reachability

go.etcd.io/etcd/client/pkg/v3, go.etcd.io/etcd/client/pkg/v3

Etcd pkg Insecure ciphers are allowed by default

zbar, zbar

zbar - security update

rear

rear - security update

sudo

sudo - security update

ckb, ckb

Nervos CKB node panics when processing a block which parent timestamp is too new

ckb

Nervos CKB BlockTimeTooNew should not be considered as invalid block

ckb

Nervos CKB DoS: Process exists when p2p discovery protocol receives unsupported peer IP

ckb

Nervos CKB P2P DoS Attacks

PowerShell

PowerShell is subject to remote code execution vulnerability

ckb

Nervos CKB Unaligned Pointer Dereference

phpmailer/phpmailer

PHPMailer Local file inclusion

phpmailer/phpmailer

PHPMailer Shell command injection

meshcentral

Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.

github.com/siderolabs/talos, github.com/siderolabs/talos

Talos Linux ships runc vulnerable to the escape to the host attack

vyper

Vyper's external calls can overflow return data to return input buffer

org.owasp.antisamy:antisamy

Malicious input can provoke XSS when preserving comments

libowasp-antisamy-java, libowasp-antisamy-java, libowasp-antisamy-java

libowasp-antisamy-java, libowasp-antisamy-java, libowasp-antisamy-java, libowasp-antisamy-java, libowasp-antisamy-java, libowasp-antisamy-java, libowasp-antisamy-java, libowasp-antisamy-java

vyper

com.linecorp.centraldogma:centraldogma-server

Central Dogma Authentication Bypass Vulnerability via Session Leakage

AntiSamy malicious input can provoke XSS when preserving comments

Vyper external calls can overflow return data to return input buffer

ledgersmb