Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Open Redirect in openwhyd/openwhyd

openwhyd is vulnerable to URL Redirection to Untrusted Site

Inefficient Regular Expression Complexity in nltk/nltk

nltk is vulnerable to Inefficient Regular Expression Complexity

keycloak-server-spi-private: ECP SAML binding bypasses authentication flows

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.

Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender GravityZone versions prior to 3.3.8.249.

Inefficient Regular Expression Complexity in josdejong/jsoneditor

jsoneditor is vulnerable to Inefficient Regular Expression Complexity

Inefficient Regular Expression Complexity in pksunkara/inflect

inflect is vulnerable to Inefficient Regular Expression Complexity

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking

SQL Injection in wbce/wbce_cms

wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php.

Prototype Pollution in fabiocaccamo/utils.js

utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

3scale: missing validation of access token

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.

Improper Privilege Management in chatwoot/chatwoot

Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.

Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte

adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte

adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Inefficient Regular Expression Complexity in cdr/code-server

code-server is vulnerable to Inefficient Regular Expression Complexity

Prototype Pollution in mariocasciaro/object-path

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Inefficient Regular Expression Complexity in nervjs/taro

taro is vulnerable to Inefficient Regular Expression Complexity