MODERATE

Impact
Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize >= 5.0.0, < 6.0.1 when Sanitize is configured with a custom allowlist that allows noscript elements. This could result in XSS (cross-site scrip…

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with ‘./’. Successful exploitation could allow an remote unauthenticated attacker to access critical data…

Description
In SafeURL it is possible to specify a list of domains that should be matched before a request is sent out. The regex used to compare domains did not work as intended.
Impact
The regex used was:
re.match(“(?i)^%s” % domain, value)
This has …

Impact
Infinite loop in malicious code filter in certain conditions.
Workarounds
None
References

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3p73-mm7v-4f6m
https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22
https://gith…

Cross-site Scripting (XSS) – Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
References

https://nvd.nist.gov/vuln/detail/CVE-2023-0488
https://github.com/pyload/pyload/commit/46d75a3087f3237d06530d55998938e2e2bda6bd
https://huntr.dev…

Devise version before 3.5.4 uses cookies to implement a “Remember me” functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the c…

xaviershay-dm-rails Gem for Ruby contains a flaw in the execute() function in /datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb. The issue is due to the function exposing sensitive information via the process table. This may allow a local attack…

Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
References

https://nvd.nist.gov/vuln/detail/CVE-2021-36686
https://github.com/YMFE/yapi/issues/2190
https://github.com/…

All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-25350
https://security.snyk.io/vuln/SNYK-JS-PUPPETFACTER-31…

All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitizatio…