Medium
CVE-2024-56331
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
High
CVE-2024-56159
Astro's server source code is exposed to the public if sourcemaps are enabled
Medium
CVE-2024-56140
Atro CSRF Middleware Bypass (security.checkOrigin)
High
CVE-2024-54151
Directus allows unauthenticated access to WebSocket events and operations
High
CVE-2024-54134
Modified package published to npm, containing malware that exfiltrates private key material
Medium
CVE-2024-53983
Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery
Medium
CVE-2024-53843
@dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling
High
CVE-2024-32965
@lobehub/chat Server Side Request Forgery vulnerability
Low
CVE-2024-53262
@sveltejs/kit has unescaped error message included on error page
High
CVE-2024-58351
Flowise OverrideConfig security vulnerability
Medium
CVE-2024-11023
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server
Medium
CVE-2024-50336
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
Critical
CVE-2024-51757
happy-dom allows for server side code to be executed by a <script> tag
High
CVE-2024-49770
Path traversal in oak allows transfer of hidden files within the served root directory
High
CVE-2024-21536
Denial of service in http-proxy-middleware
High
CVE-2024-47824
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
High
CVE-2024-47080
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
Critical
CVE-2024-48914
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
Medium
CVE-2024-48913
Hono allows bypass of CSRF Middleware by a request without Content-Type header.
Critical
CVE-2024-42640
angular-base64-upload vulnerable to unauthenticated remote code execution
Medium
ghsa-pf56-h9qf-rxq4
Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page
High
CVE-2024-47818
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability
High
CVE-2024-47183
Parse Server's custom object ID allows to acquire role privileges
High
ghsa-fm76-w8jw-xf8m
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.