Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Mediawiki Cargo extension vulnerable to Cross-site Scripting
GitHub

mediawiki/cargo

< 3.6.1

2024-10-07 14:50:53
PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file
GitHub

phpoffice/phpspreadsheet

>= 2.2.0, < 2.3.0 · >= 2.0.0, < 2.1.1 · < 1.29.2

2024-10-07 14:43:34
Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS
GitHub

dev-lancer/minecraft-motd-parser

<= 1.0.5

2024-10-04 18:51:36
Contao allows admin an account to upload SVG file containing malicious JavaScript
GitHub

contao/contao

<= 5.4.1

2024-10-02 22:35:35
Zenario Cross Site Scripting in the Image library
GitHub

tribalsystems/zenario

<= 9.7.61188

2024-10-02 22:35:25
October allows an admin account to upload PDF containing malicious JavaScript
GitHub

october/october

<= 3.6.4

2024-10-02 22:35:21
Zenario allows authenticated admin users to upload PDF files containing malicious code
GitHub

tribalsystems/zenario

<= 9.7.61188

2024-10-02 22:35:06
LibreNMS vulnerable to Stored Cross-site Scripting via File Upload
GitHub

librenms/librenms

< 24.9.0

2024-10-01 22:27:33
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature
GitHub

librenms/librenms

< 24.9.0

2024-10-01 20:31:25
LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name
GitHub

librenms/librenms

< 24.9.0

2024-10-01 20:31:19
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature
GitHub

librenms/librenms

< 24.9.0

2024-10-01 20:31:14
LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Templates" feature
GitHub

librenms/librenms

< 24.9.0

2024-10-01 20:31:10
LibreNMS has Stored Cross-site Scripting vulnerability in "Device Dependencies" feature
GitHub

librenms/librenms

< 24.9.0

2024-10-01 20:31:06
Pagekit Cross-site Scripting vulnerability
GitHub

pagekit/pagekit

<= 1.0.18

2024-10-01 18:09:22
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
GitHub

starcitizentools/citizen-skin

>= 2.6.3, < 2.31.0

2024-09-30 17:48:33
MantisBT vulnerable to information disclosure with user profiles
GitHub

mantisbt/mantisbt

<= 2.26.3

2024-09-30 17:48:17
Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting
GitHub

filament/tables

>= 3.0.0, < 3.2.115

2024-09-27 20:51:02
IDOR vulnerability in account profile page
GitHub

aimeos/ai-controller-frontend

>= 2023.04.1, < 2023.10.9 · >= 2022.04.1, < 2022.10.8 · >= 2021.04.1, < 2021.10.8 · < 2020.10.15 · = 2024.04.1

2024-09-26 17:38:31
Cross site scripting in Concrete CMS
GitHub

concrete5/concrete5

>= 9.0.0, < 9.3.4 · < 8.5.19

2024-09-25 19:00:29
Cross site scripting in Concrete CMS
GitHub

concrete5/concrete5

>= 9.0.0, < 9.3.4 · < 8.5.19

2024-09-25 18:56:47
powermail TYPO3 extension has Insecure Direct Object Reference
GitHub

in2code/powermail

>= 12.0.0, < 12.4.1 · >= 11.0.0, < 12.4.1 · >= 9.0.0, < 10.9.1 · >= 8.0.0, < 8.5.1 · < 7.5.1

2024-09-23 16:35:14
Mautic has insufficient authentication in upgrade flow
GitHub

mautic/core

>= 1.0.0-beta3, < 4.4.13 · >= 5.0.0, < 5.1.1

2024-09-19 16:06:12
Mautic allows users enumeration due to weak password login
GitHub

mautic/core

>= 5.1.0, < 5.1.1

2024-09-18 22:10:06
Mautic has insufficient authentication in upgrade flow
GitHub

mautic/core

>= 1.0.0-beta3, < 4.4.13 · >= 5.0.0-alpha, < 5.1.1

2024-09-18 22:06:15
Mautic has an XSS in contact tracking and page hits report
GitHub

mautic/core-lib

>= 1.0.0-beta4, < 4.4.13 · >= 5.0.0-alpha, < 5.1.1

2024-09-18 22:06:00
Mautic vulnerable to XSS in contact/company tracking (no authentication)
GitHub

mautic/core

>= 5.0.0-alpha, < 5.1.1 · >= 2.6.0, < 4.4.13

2024-09-18 22:05:35
Mautic vulnerable to Cross-site Scripting (XSS) - stored (edit form HTML field)
GitHub

mautic/core

>= 5.0.0-alpha, < 5.1.1 · >= 1.0.0-beta, < 4.4.13

2024-09-18 22:05:04
auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
GitHub

damienharper/auditor-bundle

< 6.0.0 · < 5.2.6

2024-09-18 19:37:21
Mautic vulnerable to Improper Access Control in UI upgrade process
GitHub

mautic/core-lib

>= 5.0.0-alpha, < 5.1.1 · >= 1.1.3, < 4.4.13

2024-09-18 17:43:39
Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block
GitHub

concrete5/concrete5

>= 9.0.0, < 9.3.3

2024-09-17 22:02:27
czim/file-handling vulnerable to SSRF and directory traversal
GitHub

czim/file-handling

>= 2.0.0, < 2.3.0 · < 1.5.0

2024-09-17 21:23:59
Kimai has an XXE Leading to Local File Read
GitHub

kimai/kimai

<= 2.20.1

2024-09-17 18:36:50
Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content
GitHub

wireui/wireui

>= 2.0.0, < 2.1.3 · < 1.19.3

2024-09-17 18:33:15
Contao affected by insert tag injection via canonical URL
GitHub

contao/core-bundle

>= 4.13.0, < 4.13.49 · >= 5.0.0, < 5.3.15 · >= 5.4.0, < 5.4.3

2024-09-17 14:59:03
Contao affected by directory traversal in the file selector widget
GitHub

contao/core-bundle

< 4.13.49

2024-09-17 14:58:45
Contao affected by remote command execution through file upload
GitHub

contao/core-bundle

>= 4.0.0, < 4.13.49 · >= 5.0.0, < 5.3.15 · >= 5.4.0, < 5.4.3

2024-09-17 14:58:36
Concrete CMS Stored XSS in the "Next&Previous Nav" block
GitHub

concrete5/concrete5

>= 9.0.0, < 9.3.4 · < 8.5.19

2024-09-16 21:23:25
Magento Open Source Improper Authorization vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 20:10:09
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 20:09:44
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 20:09:35
Magento Open Source Cross-Site Request Forgery vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 20:09:18
Magento Open Source Path Traversal vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 18:26:16
Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint
GitHub

pxlrbt/filament-excel

>= 2.0.0-alpha, < 2.3.3 · < 1.1.14 · < 2.3.3

2024-09-16 14:55:11
EC-CUBE Open redirect vulnerability
GitHub

ec-cube/ec-cube

>= 3.0.0, <= 3.0.16 · >= 3.0.0, < 3.0.16

2024-09-13 19:33:38
XXE in PHPSpreadsheet encoding is returned
GitHub

phpoffice/phpspreadsheet

>= 2.2.0, < 2.2.1 · >= 2.0.0, < 2.2.1 · >= 2.0.0, < 2.1.1 · < 1.29.1 · < 2.2.1

2024-09-13 13:37:32
Twig has a possible sandbox bypass
GitHub

twig/twig

>= 3.12.0, < 3.14.0 · >= 3.0.0, < 3.14.0 · >= 3.0.0, < 3.11.1 · >= 2.0.0, < 2.16.1 · >= 1.0.0, < 1.44.8

2024-09-10 17:12:23
ThinkPHP deserialization vulnerability
GitHub

topthink/framework

>= 6.1.3, <= 8.0.4

2024-09-09 22:33:12
Craft CMS vulnerable to stored XSS in breadcrumb list and title fields
GitHub

craftcms/cms

>= 5.0.0, < 5.1.2

2024-09-09 18:18:28
Httpful is Missing Certificate Validation
GitHub

nategood/httpful

< 1.0.0

2024-09-09 18:18:15
Bootstrap Cross-Site Scripting (XSS) vulnerability
GitHub

twbs/bootstrap

>= 4.0.0, <= 4.6.2

2024-09-06 19:07:45
« Previous Next »

Showing 201 to 250 of 4252 results

1 2 3 4 5 6 7 8 9 10 ... 85 86