漏洞公告

parse-server new anonymous user session acts as if it's created with password

Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`

Argo Server TLS requests could be forged by attacker with network access

Privilege escalation via form generator

PHP file inclusion via insert tags

Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality

Widget feature vulnerability allowing to execute JavaScript code using undo functionality

Special Element Injection in notebook

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

Cross-Site Scripting via Rich-Text Content

Improper Authorization and Origin Validation Error in OneFuzz

Timing based private key exposure in Bouncy Castle

Padding oracle attacks

Cross-site scripting in jfinal

XML External Entity Reference

Druid ingestion system Authenticated users can read data from other sources than intended

Cross-site scripting in Apache Jena Fuseki

Authentication Bypass by Alternate Name in Apache Tomcat

HTTP Request Smuggling in Apache Tomcat

Improper Handling of Exceptional Conditions in Apache Tomcat

Clipboard-based DOM-XSS

Open Redirect in Next.js

Command injection in Yamale