Open Source Vulnerabilities

Path traversal vulnerabilities in DSpace JSPUI submission upload

URL Redirection to Untrusted Site in Dspace JSPUI

"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

mTLS client verification is skipped in fs2 on Node.js

Email activation route can be abused by spammers in Discourse

Cache poisoning via maliciously-formed request in Discourse

Remote code execution in prestashop

Leakage of excessive information into log in next-auth

Email addresses are not hidden regardless of selected state in mprweb

Insufficient escaping of line feeds for CMD in shescape

Insufficient escaping of whitespace in shescape

flask-appbuilder

Improper Authorization in eLabFTW

Possible to infer sensitive information through query strings in Flask-AppBuilder

Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

Persistent cross site scripting in customer module in Shopware

Redirection of DNS domain in eth.link domain name version 2022-07-31 and later

Fine grained permissions are not checked in Tuleap

HTTP Host Header Attack Vulnerability in laminas-diactoros

golang, go-toolset

Important: go-toolset and golang security and bug fix update

unbound, unbound, unbound

unbound, unbound, unbound, unbound, unbound, unbound, unbound, unbound

unbound, unbound, unbound

unbound, unbound, unbound, unbound, unbound, unbound, unbound, unbound

vim, vim, vim

fava

vim, vim, vim

unbound

CVE-2022-30699 affecting package unbound for versions less than 1.16.2-1

unbound

CVE-2022-30698 affecting package unbound for versions less than 1.16.2-1

vim

CVE-2022-2598 affecting package vim for versions less than 9.0.0325-1

vim

CVE-2022-2581 affecting package vim for versions less than 9.0.0325-1

vim

CVE-2022-2580 affecting package vim for versions less than 9.0.0325-1

vim, vim, vim

vim

CVE-2022-2571 affecting package vim for versions less than 9.0.0325-1

node-fetch, node-fetch, node-fetch, node-fetch, node-fetch, node-fetch, node-fetch

fava, fava, fava, fava, fava