Critical
CVE-2024-21534
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Low
CVE-2024-48949
Elliptic's verify function omits uniqueness validation
Medium
CVE-2024-21533
ggit is vulnerable to Arbitrary Argument Injection via the clone() API
Medium
CVE-2024-45277
SAP HANA Node.js client package vulnerable to Prototype Pollution
Medium
CVE-2024-21532
ggit is vulnerable to Command Injection via the fetchTags(branch) API
Medium
ghsa-pf56-h9qf-rxq4
Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page
High
CVE-2024-47818
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability
Low
CVE-2024-47764
cookie accepts cookie name, path, and domain with out of bounds characters
High
CVE-2024-47183
Parse Server's custom object ID allows to acquire role privileges
High
ghsa-fm76-w8jw-xf8m
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
Low
CVE-2024-9266
Express Open Redirect vulnerability
High
ghsa-78p3-fwcq-62c2
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings
Medium
ghsa-cfqx-f43m-vfh7
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
Medium
ghsa-277h-px4m-62q8
@saltcorn/server arbitrary file zip read and download when downloading auto backups
Medium
ghsa-593m-55hh-j8gv
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
Medium
CVE-2024-47762
Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Medium
CVE-2024-9440
Slim Select has potential Cross-site Scripting issue
Medium
CVE-2024-47529
OpenC3 stores passwords in clear text (`GHSL-2024-129`)
Medium
CVE-2024-43795
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)
Medium
CVE-2024-21531
git-shallow-clone Argument Injection vulnerability
High
CVE-2024-21489
uPlot Prototype Pollution vulnerability
High
CVE-2024-47178
basic-auth-connect's callback uses time unsafe string comparison
Low
CVE-2024-9283
ReLaXed Cross-site Scripting vulnerability
Low
CVE-2024-47171
Agnai vulnerable to Relative Path Traversal in Image Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.