漏洞公告

Dom4j contains a XML Injection vulnerability

High severity vulnerability that affects YamlDotNet and YamlDotNet.Signed

dojox vulnerable to unescaped string injection

Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page

ReDoS via long string of semicolons in tough-cookie

Moderate severity vulnerability that affects sprockets

Insecure use of temporary files in Phusion passenger

Insecure use of temporary files in passenger

Phusion Passenger allows remote attackers to spoof headers

mongose is malware

node-openssl is malware

Cross-Site Scripting in public

Denial of Service in memjs

Ansible does not verify that the server hostname matches a domain name in certificates

Link Following in ansible

Ansible fails to cache SSH host keys

Improper Input Validation in ansible

Ansible apt_key module does not properly verify key fingerprint

Ansible exposes sensitive data in log files and on the terminal

Ansible fails to properly sanitize fact variables sent from the Ansible controller

Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems

In marshmallow library the schema "only" option treats an empty list as implying no "only" option

PyOpenSSL Use-After-Free vulnerability