漏洞公告

Cross-site Scripting in Gogs

SQL Injection in Gogs

SQL Injection in gogs.io/gogs

Open Redirect

Arbitrary Command Injection

Missing Authentication for Critical Function

Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem

List of order ids, number, items total and token value exposed for unauthorized uses via new API

Regular Expression Denial of Service (ReDoS) in Prism

non-admin users can create integration role with administrator role

Internal hidden fields are visible on to many associations in admin api

Private files publicly accessible with Cloud Storage providers

Cross-site scripting

Improper Verification of Cryptographic Signature

Creation of order credits was not validated by acl in admin orders

Canceling of orders not related to the logged-in user

Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19

Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19

Reflected cross-site scripting in development mode handler in Vaadin

Reflected XSS from the callback handler's error query parameter

XXE vulnerability in Launch import

XXE vulnerability on Launch import with externally-defined DTD file

Improper Privilege Management in HashiCorp Nomad