High
ghsa-m4gq-x24j-jpmf
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2024-47819
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
High
CVE-2024-48930
secp256k1-node allows private key extraction over ECDH
High
CVE-2024-21536
Denial of service in http-proxy-middleware
High
CVE-2024-47824
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
High
CVE-2024-47080
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
Critical
CVE-2024-48914
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
Medium
CVE-2024-48913
Hono allows bypass of CSRF Middleware by a request without Content-Type header.
Low
CVE-2024-48948
Valid ECDSA signatures erroneously rejected in Elliptic
Medium
CVE-2024-47885
DOM Clobbering Gadget found in astro's client-side router that leads to XSS
Medium
CVE-2024-47831
Denial of Service condition in Next.js image optimization
Critical
CVE-2024-42640
angular-base64-upload vulnerable to unauthenticated remote code execution
High
CVE-2024-47875
DOMpurify has a nesting-based mXSS
Medium
CVE-2024-45277
SAP HANA Node.js client package vulnerable to Prototype Pollution
Medium
ghsa-pf56-h9qf-rxq4
Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page
High
CVE-2024-47818
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability
Low
CVE-2024-47764
cookie accepts cookie name, path, and domain with out of bounds characters
High
ghsa-fm76-w8jw-xf8m
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
High
ghsa-78p3-fwcq-62c2
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings
Medium
ghsa-cfqx-f43m-vfh7
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
Medium
ghsa-277h-px4m-62q8
@saltcorn/server arbitrary file zip read and download when downloading auto backups
Medium
ghsa-593m-55hh-j8gv
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
Medium
CVE-2024-47762
Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Medium
CVE-2024-43795
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.