Open Source Vulnerabilities

squid, squid

Security update for squid

Stackrox: missing http security headers allows for clickjacking in web ui

Reflected client side path traversal leading to CSRF in Playbooks

Playbooks access/modification by removed team member

Playbook plugin crash via missing interface type assertion

Todo plugin gets crashed and disabled by member

Inaccessible Post Information Leak via Run Timeline IDOR

IDOR when updating the tasks of a private playbook run

Playbook Plugin Crash via Run Checklist

mlflow

Jinja2 template injection in mlflow

mlflow

Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

github.com/sap/cloud-security-client-go

Duplicate Advisory: Privilege escalation in sap/cloud-security-client-go

com.sap.cloud.security:java-security, com.sap.cloud.security:java-security, com.sap.cloud.security.xsuaa:spring-xsuaa, com.sap.cloud.security.xsuaa:spring-xsuaa, com.sap.cloud.security:spring-security, com.sap.cloud.security:spring-security

Duplicate Advisory: Improper JWT Signature Validation in SAP Security Services Library

@sap/xssec

Escalation of privileges in @sap/xssec

sap-xssec

Duplicate Advisory: Privilege escalation in sap-xssec

curl, curl, curl

curl, curl, curl, curl, curl, curl, curl, curl, curl, curl

cmake

CVE-2023-46219 affecting package cmake for versions less than 3.29.6-1

mysql

CVE-2023-46219 affecting package mysql for versions less than 8.0.40-1

mysql

CVE-2023-46219 affecting package mysql for versions less than 8.0.40-1

curl

CVE-2023-46219 affecting package curl for versions less than 8.5.0-1

sap-xssec

Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)

Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)