漏洞公告

Bypass of fix for CVE-2020-15247, Twig sandbox escape

Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.

Local File Inclusion by unauthenticated users

Stored XSS by authenticated backend user with access to upload files

Privilege escalation by backend users assigned to the default "Publisher" system role

Secret disclosure when containing characters that become URI encoded

Open redirect in Jupyter Notebook

Cross-Site Scripting through Fluid view helper arguments

Reflected XSS with parameters in PostComment

XStream can be used for Remote Code Execution

Persistent XSS in newsletter module in Shopware

Persistent XSS in shopping worlds

Vulnerability in RPKI manifest validation

Float cast overflow undefined behavior

Authorization bypass in Spree

Segfault in `tf.quantization.quantize_and_dequantize`

Remote code execution in dependabot-core branch names when cloning

Persistent XSS in customer module in Shopware

Prototype Pollution in json-logic-js

Exploitable inventory component chaining in PocketMine-MP

MoinMoin vulnerable to remote code execution via cache action

malicious SVG attachment causing stored XSS vulnerability

Web Cache Poisoning in find-my-way