Open Source Vulnerabilities

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API

List category posts <= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Paid Memberships Pro <= 2.12.5 - Missing Authorization via API

LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

swftools, swftools

CVE-2023-4001 does not affect BellSoft software

XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode

Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC

golang-1.20, golang-1.21, golang-1.20, golang-1.21

Go vulnerabilities

jinja2, jinja2, jinja2

py3-jinja2, py3-jinja2, py3-jinja2, py3-jinja2, py3-jinja2, py3-jinja2, py3-jinja2, py3-jinja2

py3-jinja2, py3-jinja2

python-jinja2

CVE-2024-22195 affecting package python-jinja2 for versions less than 3.1.2-2

nodejs

CVE-2024-22195 affecting package nodejs for versions less than 20.14.0-1

nodejs18

CVE-2024-22195 affecting package nodejs18 for versions less than 18.20.3-3

python-jinja2

CVE-2024-22195 affecting package python-jinja2 for versions less than 3.0.3-3

cdo-local-uuid

jinja2, jinja2, jinja2, jinja2, jinja2, jinja2

case-utils

firefox

firefox regressions

Jinja vulnerable to Cross-Site Scripting (XSS)

cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code

gitpython

python-git, python-git, python-git, python-git, python-git, python-git, python-git, python-git

Untrusted search path under some conditions on Windows allows arbitrary code execution

Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts

Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list