漏洞公告

Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow

Duplicate Advisory: GHSA-x698-5hjm-w2m5

Duplicate Advisory: rust-protobuf crate is vulnerable to Uncontrolled Recursion, potentially leading to DoS

sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow

sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

Withdrawn Advisory: microlight allows a denial of service

Withdrawn Advisory: microlight.js has a null pointer dereference vulnerability

Duplicate Advisory: users may append `root` to group listings

Duplicate Advisory: Pingora Request Smuggling and Cache Poisoning

Duplicate Advisory: crossbeam-channel Vulnerable to Double Free on Drop

Duplicate Advisory: ring has some AES functions that may panic when overflow checking is enabled in

Duplicate Advisory: `allowed_domains` can be bypassed by putting a decoy domain in http auth username portion of a URL

Duplicate Advisory: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

Duplicate Advisory: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

Duplicate Advisory: Keycloak hostname verification

Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass

Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate

Duplicate Advisory: Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint

Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS

Duplicate Advisory: Leantime affected by Improper Neutralization of HTML Tags

Duplicate Advisory: @alizeait/unflatto Prototype Pollution via `exports.unflatto` Method

Duplicate Advisory: HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store

Duplicate Advisory: D-Tale Command Injection vulnerability