Open Source Vulnerabilities

Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated

org.springframework.amqp:spring-amqp

TuxCare security update for org.springframework.amqp:spring-amqp (1 CVE)

Unescaped header separators in whatstk build a regular expression that backtracks exponentially

MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value

MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoning

io.netty:netty-codec, io.netty:netty-codec-http, io.netty:netty-codec-mqtt, io.netty:netty-codec-redis, io.netty:netty-resolver-dns, io.netty:netty-transport-sctp

TuxCare security update for io.netty (10 CVEs)

org.apache.logging.log4j:log4j-core

TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)

isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)

isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)

isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout

org.springframework.hateoas:spring-hateoas

TuxCare security update for org.springframework.hateoas:spring-hateoas (1 CVE)

Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export

Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write

Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx

Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data

Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters

org.springframework.security:spring-security-web

TuxCare security update for org.springframework.security:spring-security-web (1 CVE)

io.projectreactor:reactor-core

TuxCare security update for io.projectreactor:reactor-core (1 CVE)

io.netty:netty-codec, io.netty:netty-codec-http, io.netty:netty-handler, io.netty:netty-handler-proxy

TuxCare security update for io.netty (8 CVEs)

ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)

org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-coyote

TuxCare security update for 4 packages (3 CVEs)

kernel-default, kernel-default-base, kernel-kvmsmall, kernel-source

Security update for the Linux Kernel

org.hibernate.validator:hibernate-validator, org.hibernate:hibernate-validator

TuxCare security update for 2 packages (1 CVE)

AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

ash_authentication,

AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

org.codehaus.plexus:plexus-utils

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

mongo-c-driver, mongo-c-driver, mongo-c-driver

mongo-c-driver, mongo-c-driver, mongo-c-driver

mongo-c-driver, mongo-c-driver, mongo-c-driver

mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver

mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver

mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver

mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver

mongo-c-driver, mongo-c-driver, mongo-c-driver

mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver, mongo-c-driver

com.nimbusds:nimbus-jose-jwt

TuxCare security update for com.nimbusds:nimbus-jose-jwt (1 CVE)

fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

org.codehaus.plexus:plexus-utils

TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

io.netty:netty-codec, io.netty:netty-codec-dns, io.netty:netty-codec-http, io.netty:netty-codec-redis, io.netty:netty-codec-smtp, io.netty:netty-handler

TuxCare security update for io.netty (7 CVEs)

org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina

TuxCare security update for 3 packages (3 CVEs)

com.google.guava:guava

TuxCare security update for com.google.guava:guava (1 CVE)

Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

org.springframework.security:spring-security-core, org.springframework.security:spring-security-web

TuxCare security update for org.springframework.security (3 CVEs)

org.jline:jline-remote-telnet

TuxCare security update for org.jline:jline-remote-telnet (1 CVE)

org.jsoup:jsoup

TuxCare security update for org.jsoup:jsoup (1 CVE)

com.google.guava:guava

TuxCare security update for com.google.guava:guava (1 CVE)

org.springframework.security:spring-security-web

TuxCare security update for org.springframework.security:spring-security-web (1 CVE)