Open Source Vulnerabilities

ghostscript

Heap-buffer-overflow in pdfi_load_font

xstream

Uncaught exception in com.ctc.wstx.dtd.FullDTDReader.readContentSpec

linux-hwe-edge, linux-aws-5.0, linux-aws-5.3, linux-azure, linux-azure-5.3, linux-azure-edge, linux-gcp, linux-gcp-5.3, linux-gke-4.15, linux-hwe, linux-hwe-edge, linux-oem, linux-oracle-5.0, linux-oracle-5.3, linux-aws-5.11, linux-aws-5.13, linux-aws-5.8, linux-azure-5.11, linux-azure-5.13, linux-azure-5.8, linux-gcp-5.11, linux-gcp-5.13, linux-gcp-5.8, linux-hwe-5.11, linux-hwe-5.13, linux-hwe-5.8, linux-intel-5.13, linux-oem-5.10, linux-oem-5.13, linux-oem-5.6, linux-oracle-5.11, linux-oracle-5.13, linux-oracle-5.8, linux-raspi2, linux-riscv, linux-riscv-5.11, linux-riscv-5.8, linux-oem-5.17

unzip

unzip - security update

gnutls28

gnutls28 - security update

exim4, exim4, exim4

exim4, exim4, exim4, exim4

crash, crash

Security update for crash

tauri

`tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope

open62541

Heap-use-after-free in UA_Server_networkCallback

mruby

Heap-buffer-overflow in udiv

jackson-databind

Security exception in com.fasterxml.jackson.databind.node.ArrayNode.serialize

libarchive

Heap-use-after-free in archive_read_data

chromium

chromium - security update

libtirpc

libtirpc - security update

exim4, exim4, exim4

exim4

trivy, trivy

Security update for trivy

kernel-linus

Updated kernel-linus packages fix security vulnerabilities

kernel, kmod-virtualbox, kmod-xtables-addons

Updated kernel packages fix security vulnerabilities

caddy, caddy

Security update for caddy

@ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-html-support, @ckeditor/ckeditor5-html-embed

CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

drupal/core, drupal/core

Drupal core arbitrary PHP code execution

streamlit

Streamlit directory traversal vulnerability

org.postgresql:postgresql, org.postgresql:postgresql, org.postgresql:postgresql

PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names

org.dspace:dspace-api, org.dspace:dspace-api

DSpace ItemImportService API Vulnerable to Path Traversal in Simple Archive Format Package Import

org.dspace:dspace-jspui, org.dspace:dspace-jspui

JSPUI vulnerable to path traversal in submission (resumable) upload

org.dspace:dspace-jspui, org.dspace:dspace-jspui

JSPUI's controlled vocabulary feature vulnerable to Open Redirect before v6.4 and v5.11

org.dspace:dspace-jspui, org.dspace:dspace-jspui

JSPUI Possible Cross Site Scripting in "Request a Copy" Feature

org.dspace:dspace-jspui, org.dspace:dspace-jspui

JSPUI spellcheck and autocomplete tools vulnerable to Cross Site Scripting

org.dspace:dspace-xmlui

XMLUI's metadata of withdrawn Items is exposed to anonymous users

org.dspace:dspace-jspui

JSPUI's "Internal System Error" page prints exceptions and stack traces without sanitization

@solana/pay

Solana Pay Vulnerable to Weakness in Transfer Validation Logic

drupal/core, drupal/core, drupal/core

Drupal core Information Disclosure vulnerability

untangle

untangle vulnerable to XML Entity Expansion

untangle

untangle vulnerable to Improper Restriction of XML External Entity Reference

next-auth, next-auth

next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

sanic, sanic, sanic

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

fof/byobu

Byobu user preference to prevent private discussions being started are not respected

websocket

Rust-WebSocket memory allocation based on untrusted length

rdkit

Heap-buffer-overflow in void RDKit::ParseV3000AtomProps<std::__1::vector<std::__1::basic_string_view<cha

@acrontum/filesystem-template

@acrontum/filesystem-template vulnerable to Command Injection due to fetchRepo API missing sanitization

administrate

administrate vulnerable to Cross-Site Request Forgery

moodle/moodle

Moodle XSS Vulnerability

io.undertow:undertow-core, io.undertow:undertow-core

Undertow vulnerable to Dos via Large AJP request

org.keycloak:keycloak-saml-core

Keycloak allows arbitrary Javascript to be uploaded for SAML protocol mapper even if UPLOAD_SCRIPTS feature disabled