Open Source Vulnerabilities

libredwg

Heap-buffer-overflow in dwg_decode_LWPOLYLINE_private

ghostscript

UNKNOWN WRITE in pdfi_repair_file

libredwg

Heap-buffer-overflow in dwg_geojson_feature

libpgjava, libpgjava

libpgjava - security update

oqs

Post-Quantum Key Encapsulation Mechanism SIKE broken

libtirpc, libtirpc, libtirpc

libtirpc security update

kernel, kernel, kernel

kernel security update

netcdf

netcdf security update

python-ldap, python-ldap

python-ldap security update

qemu, qemu, qemu

qemu security update

python-lxml, python-lxml, python-lxml

python-lxml security update

protobuf-c

protobuf-c security update

flatpak-builder

flatpak-builder security update

qt5-qtbase, qt5-qtbase

qt5-qtbase security update

openjdk-1.8.0, openjdk-1.8.0, openjdk-1.8.0

openjdk-1.8.0 security update

evolution-data-server, evolution-data-server

evolution-data-server security update

httpd, httpd, httpd

httpd security update

github.com/containrrr/shoutrrr

Panic on crafted messages in github.com/containrrr/shoutrrr

github.com/flyteorg/flyteadmin

Improper validation of access tokens in github.com/flyteorg/flyteadmin

github.com/ipld/go-car, github.com/ipld/go-car/v2

Denial of service via malformed CAR data in github.com/ipld/go-car and go-car/v2

libredwg

Heap-double-free in dwg_free_common_entity_data

github.com/runatlantis/atlantis

Atlantis Events vulnerable to Timing Attack

org.eclipse.californium:californium-core, org.eclipse.californium:californium-core

Eclipse Californium denial of service (DoS) via Datagram Transport Layer Security (DTLS) handshake on parameter mismatch

chia-blockchain

chia-blockchain tokens can be inflated to an arbitrary extent

thunderbird, thunderbird

thunderbird - security update

tiff, tiff, tiff

tiff, tiff, tiff, tiff, tiff, tiff, tiff, tiff, tiff, tiff

openjpeg2

CVE-2022-34526 affecting package openjpeg2 2.3.1-12

libtiff

CVE-2022-34526 affecting package libtiff for versions less than 4.4.0-3

tiff, tiff, tiff, tiff, tiff

juniper

Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

flask-appbuilder

Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

prestashop/prestashop

PrestaShop eval injection possible if shop vulnerable to SQL injection

scrapy, scrapy

Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another

mezzio/mezzio-swoole, mezzio/mezzio-swoole

mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack

co.fs2:fs2-io, co.fs2:fs2-io_2.12, co.fs2:fs2-io_3, co.fs2:fs2-io_2.13, co.fs2:fs2-io_sjs1_2.13, co.fs2:fs2-io_sjs1_3

fs2-io skips mTLS client verification

async-graphql

async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflow

chia-blockchain