漏洞公告

HAXcms createSite SSRF Enables Arbitrary File Read

Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

Algernon: handler.lua discovery walks parent directories above the server root

Algernon: Single-file mode unconditionally enables debug mode

Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString

Malware in @opensearch-project/opensearch

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak

Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability

Keycloak: Access token disclosure and implicit flow bypass via forged client data

Keycloak: Session fixation in OIDC login flow that can lead to account takeover

Keycloak: Denial of Service via specially crafted SAML input

Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers

Keycloak: Unauthorized account takeover via WebAuthn token replay

Keycloak Account Resources user lookup contains broken access control

TYPO3 sf_register extension allows unauthorized assignment of frontend user groups

Keycloak: Information Disclosure via evaluate-scopes Admin API

TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)

georgringer/news has SQL Injection in extension "News system" (news)

TYPO3 ke_search XML External Entity Injection

TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer

TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)

TYPO3 ke_search path traversal from arbitrary table configuration input