漏洞公告

Sinatra Cross-site Scripting vulnerability

Cross-Site Scripting in @ckeditor/ckeditor5-link

rails-html-sanitizer Cross-site Scripting vulnerability

Prototype Pollution in hoek

Cross-Site Scripting in @risingstack/protect

Uncontrolled resource consumption in nokogiri

Electron protocol handler browser vulnerable to Command Injection

Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration

Cross-site Scripting in loofah

Sanitize vulnerable to Improper Input Validation and Cross-site Scripting

Cap-Strap gem for Ruby places credentials on the useradd command line

Doorkeeper is vulnerable to stored XSS and code execution

tiny-json-http missing SSL certificate validation

pym.js CSRF Vulnerability

http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Auth0-js bypasses CSRF checks

rack-protection gem timing attack vulnerability when validating CSRF token

Regular Expression Denial of Service in ssri

bson is vulnerable to denial of service due to incorrect regex validation

rails_admin ruby gem XSS

Insight API transaction broadcast endpoint can result in Full Path Disclosure

brbackup exposes database password to unauthorized users

AWS Lambda parser is vulnerable to Regular Expression Denial of Service