Vulnerabilities published in 2023
42,916 vulnerabilities were published in 2023: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 121 of 430.
- GHSA-wxf3-4fvj-vqqx Unsafe plugins can be installed via pack import by tenant admins
- GHSA-wvc4-j7g5-4f79 NATS TLS certificate common name validation bypass
- GHSA-wqm8-jx8r-8rcq Cross-site scripting vulnerabilities in old version of bundled TinyMCE
- GHSA-wqcr-xm43-hpqr Vulnerable version of libwebp and can be exploited with a malicious source image
- GHSA-wm8x-php5-hvq6 Maligned causes incorrect deallocation
- GHSA-wm63-7627-ch33 @vendure/core's insecure currencyCode handling allows wrong payment amounts
- GHSA-wjfc-pgfp-pv9c Improper Input Validation in nyholm/psr7
- GHSA-wj7f-468m-6mv8 Environment variables still accessible through /proc
- GHSA-wfg4-322g-9vqv memoffset allows reading uninitialized memory
- GHSA-w9mr-28mw-j8hg Hop-by-hop abuse to malform header mutator
- GHSA-w98g-5fmx-wm4x pocketmine/raklib reliable-ordered queue size is unlimited, allowing a session to hog server memory
- GHSA-w7hm-hmxv-pvhf HPACK decoder panics on invalid input
- GHSA-w6rp-vxj2-fjhr Cosmos packet-forward-middleware vulnerable to chain-halt
- GHSA-w5w5-2882-47pc github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee
- GHSA-w4x6-hh3x-wjrx Stale copy of the public suffix list
- GHSA-vx74-f528-fxqg github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
- GHSA-v8gr-m533-ghj9 Vulnerable OpenSSL included in cryptography wheels
- GHSA-v7hc-87jc-qrrr Impact The eventing-github cluster-local server doesn't set `ReadHeaderTimeout` which could lead do a DDoS attack, where a large gro
- GHSA-v6xp-ccvx-w52m Json response for search reveals Solr credentials
- GHSA-rrwm-8wqm-gwgv Cross-site Scripting (XSS) - stored in Print Documents
- GHSA-rqr8-pxh7-cq3g Ethereum ABI decoder DoS when parsing ZST
- GHSA-rm8v-mxj3-5rmq github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack
- GHSA-rjjm-x32p-m3f7 gnark's range checker gadget allows wider inputs up to word alignment
- GHSA-rfhg-rjfp-9q8q Potential denial of service after connection migration
- GHSA-rcx8-48pc-v9q8 mail-internals use-after-free vulnerability in `vec_insert_bytes`
- GHSA-rc4v-99cr-pjcm Prototype Pollution in ali-security/mongoose
- GHSA-r68h-jhhj-9jvm Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year
- GHSA-r3hf-q8q7-fv2p Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory
- GHSA-r3fg-3r88-6x3f Ibexa User Settings are accessible on the front-end for anonymous user
- GHSA-r2xv-vpr2-42m9 slsa-verifier vulnerable to mproper validation of npm's publish attestations
- GHSA-r2h5-3hgw-8j34 User data in TPM attestation vulnerable to MITM
- GHSA-r24f-hg58-vfrw unsafe-libyaml unaligned write of u64 on 32-bit and 16-bit platforms
- GHSA-qxh3-jgvh-x55j Connect-CMS Privilege Escalation Vulnerability
- GHSA-qvqg-6rp8-4p9h github.com/ipfs/kubo affected by DOS Bitswap unbounded persistent memory leak
- GHSA-qvc4-78gw-pv8p Adverserial use of `make_bitflags!` macro can cause undefined behavior
- GHSA-qfc5-6r3j-jj22 Go package github.com/cosmos/cosmos-sdk module x/crisis does NOT cause chain halt
- GHSA-qf87-q4gg-cg43 bottlerocket dependency openssl is vulnerable to dereferenced null pointers
- GHSA-q95j-488q-5q3p Apiman Manager API affected by Jackson denial of service vulnerability
- GHSA-q95h-cqrv-8jv5 ExifTool vulnerable to arbitrary code execution
- GHSA-q79m-c546-2g63 CakePHP vulnerable to Denial of Service attack through XML payloads
- GHSA-q4pp-j36h-3gqg Minimal `basti` IAM Policy Allows Shell Access
- GHSA-pxqj-xrv5-qvjf XML-RPC for PHP's debugger vulnerable to possible XSS attack
- GHSA-pqpw-89w5-82v5 `simd-json-derive` vulnerable to `MaybeUninit` misuse
- GHSA-ppjr-267j-5p9x NULL pointer dereference in `stb_image`
- GHSA-pjjw-qhg8-p2p9 aiohttp has vulnerable dependency that is vulnerable to request smuggling
- GHSA-pj34-fpw3-83qj bottlerocket dependency openssl is vulnerable to read buffer overflow via X.509 verification
- GHSA-pgjv-jrg2-gq3v dompurify vulnerable to Cross-site Scripting
- GHSA-pffg-92cg-xf5c gnark-crypto's exponentiation in the pairing target group GT using GLV can give incorrect results
- GHSA-p76f-wr22-4rv6 CakePHP vulnerable to Remote File Inclusion through View template name manipulation
- GHSA-p2gm-ffr3-w2xw Nervos CKB vulnerable to low-resource flood DDoS attacks through network message
- GHSA-mvrp-3cvx-c325 Zod denial of service vulnerability during email validation
- GHSA-mrrw-grhq-86gf Ascii allows out-of-bounds array indexing in safe code
- GHSA-mrr8-v49w-3333 sweetalert2 contains potentially undesirable behavior
- GHSA-mhgm-52vg-pvvc Privilege escalation in Strongbox
- GHSA-mgc4-wqv7-4pxm SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
- GHSA-mc8h-8q98-g5hr Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU)
- GHSA-m95x-m25c-w9mp XML-RPC for PHP allows access to local files via malicious argument to the Client::send method
- GHSA-m8fw-p3cr-6jqc Cross-Site Scripting in CKEditor4 WordCount Plugin
- GHSA-jxcx-3h54-qqxx SilverStripe CMS Cross-site Scripting vulnerabilities inherited from TinyMCE
- GHSA-jq35-85cj-fj4p /sys/devices/virtual/powercap accessible by default to containers
- GHSA-jm77-qphf-c4w8 pyca/cryptography's wheels include vulnerable OpenSSL
- GHSA-jjgp-whrp-gq8m in-toto: PGP trust model not (fully) considered
- GHSA-jgvc-jfgh-rjvv Chosen Ciphertext Attack in Jose4j
- GHSA-jcr6-4frq-9gjj Users vulnerable to unaligned read of `*const *const c_char` pointer
- GHSA-j9q2-f9q7-jhgq CakePHP SecurityComponent cross form submission issue
- GHSA-j859-pmrq-9q6c bottlerocket dependency openssl has a double free vulnerability
- GHSA-j79x-vvgm-w73w bottlerocket dependency openssl provides streaming of ASN.1 data via a BIO
- GHSA-j646-gj5p-p45g CefSharp affected by heap buffer overflow in WebP
- GHSA-j5g3-5c8r-7qfx Prevent logging invalid header values
- GHSA-j57r-4qw6-58r3 rusty_paseto vulnerable to private key extraction due to ed25519-dalek dependency
- GHSA-j4g3-3q8x-jxqp dbt-core's secret env vars written to package-lock.json in plaintext
- GHSA-j3rq-4xjw-xg63 Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
- GHSA-j2cr-jc39-wpx5 Barberry Security Advisory - regarding x/auth periodic vesting accounts
- GHSA-hxq4-mx37-fqvg s2n-quic potential denial of service vulnerability when receiving empty UDP packets
- GHSA-hxp2-xqf3-v83h Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
- GHSA-hw6r-g8gj-2987 Actions expression injection in `filter-test-configs` (`GHSL-2023-181`)
- GHSA-hq58-p9mv-338c Amulet Security Advisory for CometBFT: ASA-2023-002 **Component**: CometBFT **Criticality:** Low **Affected versions:** All **Affected us
- GHSA-hj8m-9fhf-v7jp fief-server Server-Side Template Injection vulnerability
- GHSA-hfxh-rjv7-2369 Uptime Kuma Authenticated remote code execution via TailscalePing
- GHSA-hfmc-7525-mj55 AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC
- GHSA-hc5c-r8m5-2gfh plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait
- GHSA-h9wq-xcqx-mqxm Vendure Cross Site Request Forgery vulnerability impacting all API requests
- GHSA-h6p3-p4vx-wr8q dompurify vulnerable to Cross-site Scripting
- GHSA-h24c-6p6p-m3vx tss-lib leaks secret keys in response to incorrectly constructed Paillier moduli
- GHSA-gv2c-5g79-h73c Ibexa ezplatform-kernel download route allows filename change
- GHSA-gpv5-7x3g-ghjv fast-xml-parser regex vulnerability patch could be improved from a safety perspective
- GHSA-gm68-572p-q28r @vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability
- GHSA-ghc8-5cgm-5rpf Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime
- GHSA-gch5-hwqf-mxhp Unsoundness in `intern` methods on `intaglio` symbol interners
- GHSA-g95c-xc83-8353 Ibexa DXP Download route allows filename change
- GHSA-g753-ghr7-q33w cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new`
- GHSA-g6w6-h933-4rc5 Soketi was exposed to Sandbox Escape vulnerability via vm2
- GHSA-g3j5-mpp2-2fqm symfont/process typosquatting malware spoofs symfony/process
- GHSA-g35x-j6jj-8g7j @mittwald/kubernetes's secret contents leaked via debug logging
- GHSA-fwj4-72fm-c93g Under-validated ComSpec and cmd.exe resolution in Mutagen projects
- GHSA-fq33-vmhv-48xh ntru-rs has unsound FFI: Wrong API usage causes write past allocated area
- GHSA-fjx5-qpf4-xjf2 Parsing borsh messages with ZST which are not-copy/clone is unsound
- GHSA-fjj4-2q73-jvgc Nervos CKB calculation of program load cycles may be missed when executing in resume mode
- GHSA-f9pm-4g9p-6vm3 Bundled libwebp in pywebp vulnerable
- GHSA-f9g6-fp84-fv92 impl `FromMdbValue` for bool is unsound