漏洞公告

Authenticated XML External Entity Processing

Prototype pollution in object-path

Ability to switch customer email address on account detail page and stay verified

Inline attribute values were not processed.

Unprotected dynamically loaded chunks

Regular Expression Denial of Service in npm-user-validate

Memory exhaustion in http4s-async-http-client with large or malicious compressed responses

Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint

RCE in XWiki

Ciphertext Malleability Issue in Tink Java

Privilege Escalation in Channelmgnt plug-in for Sopel

Cross-site Scripting in Joplin

TemporaryFolder on unix-like systems does not limit access to created files

Sensitive data exposure in NATS

Command Injection in jison

XSS vulnerability when listing users on add & modify server pages.

Cross-Site Scripting in ternary conditional operator

Open Redirect in Next.js versions

Man-in-the-middle attack in Apache Axis

Directory Traversal vulnerability in GET/PUT allows attackers to Disclose Information or Write Files via a crafted GET/PUT request

Context isolation bypass in Electron

Unpreventable top-level navigation

Possible timing attack in derivation_endpoint