Open Source Vulnerabilities

pocketmine/pocketmine-mp

PocketMine-MP invalid skin geometry JSON data leading to server crash

fc-rpc

Incorrect parsing of EVM reversion exit reason in RPC

react-editable-json-tree

React Editable Json Tree vulnerable to arbitrary code execution via function parsing

postgresql, postgresql, postgresql13, postgresql13, postgresql14, postgresql14, postgresql14, postgresql14, postgresql15, postgresql15, postgresql15, postgresql15

postgresql-13

nbconvert, nbconvert, nbconvert

upx-ucl, upx-ucl

upx-ucl, upx-ucl

postgresql

CVE-2022-2625 affecting package postgresql for versions less than 14.5-1

nbconvert

nbconvert, nbconvert, nbconvert

upx-ucl, upx-ucl, upx-ucl

upx-ucl, upx-ucl, upx-ucl

com.github.jlangch:venice

Venice vulnerable to Partial Path Traversal issue within the functions `load-file` and `load-resource`

oqs

oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken

github.com/evmos/ethermint, github.com/evmos/evmos, github.com/crypto-org-chain/cronos, github.com/Kava-Labs/kava

Ethermint vulnerable to DoS through unintended Contract Selfdestruct

codeigniter4/shield

CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection

undici

Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

kubevirt.io/kubevirt

Duplicate Advisory: KubeVirt arbitrary host file read from the VM

@actions/core

@actions/core has Delimiter Injection Vulnerability in exportVariable

oqs

oqs's Post-Quantum Key Encapsulation Mechanism SIKE broken

@openzeppelin/contracts, @openzeppelin/contracts-upgradeable

OpenZeppelin Contracts vulnerable to ECDSA signature malleability

undici

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

apollo-server-core

apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page

Improper KubeConfig handling allows arbitrary code execution

@openzeppelin/contracts, @openzeppelin/contracts-upgradeable

OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals

nvidia390

Updated nvidia390 packages fix security vulnerabilities

ldetect-lst, nvidia-current

Updated nvidia-current packages fix security vulnerabilities

Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

linux-aws

linux-aws vulnerabilities

postgresql-10, postgresql-12, postgresql-14

postgresql-10, postgresql-12, postgresql-14 vulnerability

vim, vim, vim

vim

CVE-2022-2874 affecting package vim for versions less than 9.0.0325-1

vim

py-cord

Bots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code execution