Know what to patch next.

1. Critical, CVSS 9.85 May 2023

   AzuraCast missing brute force prevention

   Packagist azuracast/azuracast · Upgrade to 0.18.3 or later · < 0.18.3 · CVE-2023-2531 · GHSA-4m7v-wr6v-2mw5

   5 May 2023Evidence →
2. High, CVSS 7.55 May 2023

   Uncontrolled Resource Consumption in OPC UA .NET Standard Reference Server

   NuGet opcfoundation.netstandard.opc.ua.server · Upgrade to 1.4.371.86 or later · < 1.4.371.86 · CVE-2023-27321 · GHSA-vpf7-r2fv-75m9

   5 May 2023Evidence →
3. High, CVSS 7.53 May 2023

   Ghost vulnerable to information disclosure of private API fields

   npm ghost · Upgrade to 5.46.1 or later · < 5.46.1 · CVE-2023-31133 · GHSA-r97q-ghch-82j9 · amended

   3 May 2023Evidence →
4. High, CVSS 7.53 May 2023

   Rekor's compressed archives can result in OOM conditions

   Go github.com/sigstore/rekor · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2023-30551 · GHSA-2h5h-59f5-c5x9

   3 May 2023Evidence →
5. High, CVSS 7.32 May 2023

   Moodle SQL Injection vulnerability

   Packagist moodle/moodle · Upgrade to 4.2.0-rc2 (pre-release) or later · < 4.2.0-rc2 · CVE-2023-30944 · GHSA-7mmc-22g7-3xq2

   2 May 2023Evidence →
6. High, CVSS 8.72 May 2023

   Apache Spark UI vulnerable to Command Injection

   Maven org.apache.spark:spark-parent_2.12 +1 · Upgrade all 2 to 3.2.2 or later · >= 3.1.1, < 3.2.2 · CVE-2023-32007 · GHSA-59hw-j9g6-mfg3 · amended

   2 May 2023Evidence →
7. High, CVSS 8.01 May 2023

   WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account

   Packagist wwbn/avideo · Upgrade to 12.4 or later · < 12.4 · CVE-2023-30860 · GHSA-xr9h-p2rc-rpqm

   1 May 2023Evidence →
8. High, CVSS 8.71 May 2023

   Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

   PyPI flask · Upgrade to 2.3.2 or 2.2.5 by release line · >= 2.3.0, < 2.3.2; < 2.2.5 · CVE-2023-30861 · GHSA-m2qf-hxjv-5gpq · amended

   1 May 2023Evidence →
9. High, CVSS 7.61 May 2023

   Data written to GitHub Actions Cache may expose secrets

   GitHub Actions gradle/gradle-build-action · Upgrade to 2.4.2 or later · < 2.4.2 · CVE-2023-30853 · GHSA-h3qr-39j9-4r5v

   1 May 2023Evidence →
10. Critical, CVSS 9.828 Apr 2023

    Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section

    Packagist concrete5/concrete5 · Upgrade to 9.2.0 or later · < 9.2.0 · CVE-2023-28473 · GHSA-pj76-75cm-3552

    28 Apr 2023Evidence →
11. High, CVSS 7.928 Apr 2023

    Relative path traversal in mlflow

    PyPI mlflow · Upgrade to 2.3.1 or later · < 2.3.1 · CVE-2023-2356 · GHSA-x422-6qhv-p29g · amended

    28 Apr 2023Evidence →
12. High, CVSS 8.827 Apr 2023

    Remote code injection in wwbn/avideo

    Packagist wwbn/avideo · Upgrade to 12.4 or later · < 12.4 · CVE-2023-30854 · GHSA-6vrj-ph27-qfp3

    27 Apr 2023Evidence →
13. High, CVSS 8.827 Apr 2023

    SQL Injection in AssetController

    Packagist pimcore/pimcore · Upgrade to 10.5.21 or later · < 10.5.21 · CVE-2023-2338 · GHSA-4x35-vr82-xvj6

    27 Apr 2023Evidence →
14. High, CVSS 8.827 Apr 2023

    SQL Injection in Admin Translations API

    Packagist pimcore/pimcore · Upgrade to 10.5.21 or later · < 10.5.21 · CVE-2023-30850 · GHSA-jwg4-qcgv-5wg6

    27 Apr 2023Evidence →
15. High, CVSS 8.827 Apr 2023

    SQL Injection in Translation Export API

    Packagist pimcore/pimcore · Upgrade to 10.5.21 or later · < 10.5.21 · CVE-2023-30849 · GHSA-xmg8-w465-mr56

    27 Apr 2023Evidence →
16. High, CVSS 8.827 Apr 2023

    SQL Injection in Admin Search Find API

    Packagist pimcore/pimcore · Upgrade to 10.5.21 or later · < 10.5.21 · CVE-2023-30848 · GHSA-6mhm-gcpf-5gr8

    27 Apr 2023Evidence →
17. Critical, CVSS 9.127 Apr 2023

    Potential leak of authentication data to 3rd parties

    npm typed-rest-client · Upgrade to 1.8.0 or later · < 1.8.0 · CVE-2023-30846 · GHSA-558p-m34m-vpmq · amended

    27 Apr 2023Evidence →
18. High, CVSS 7.827 Apr 2023

    Insufficient token expiration in Serenity

    NuGet serenity.net.core +1 · Upgrade all 2 to 6.7.0 or later · < 6.7.0 · CVE-2023-31287 · GHSA-2hp9-3xfr-r9w2

    27 Apr 2023Evidence →
19. Critical, CVSS 9.826 Apr 2023

    Prototype Pollution in vConsole

    npm vconsole · Upgrade to 3.15.1 or later · < 3.15.1 · CVE-2023-30363 · GHSA-f737-3fh6-jf6w · amended

    26 Apr 2023Evidence →
20. High, CVSS 7.426 Apr 2023

    Hidden fields can be leaked on readable collections in Payload

    npm payload · Upgrade to 1.7.0 or later · < 1.7.0 · CVE-2023-30843 · GHSA-35jj-vqcf-f2jf · amended

    26 Apr 2023Evidence →
21. High, CVSS 8.826 Apr 2023

    Path traversal vulnerability in the file manager

    Packagist contao/contao · Upgrade to 5.1.4, 4.13.21 or 4.9.40 by release line · >= 4.9.0, < 4.9.40; >= 4.13.0, < 4.13.21; >= 5.1.0, < 5.1.4 · CVE-2023-29200 · GHSA-fp7q-xhhw-6rj3

    26 Apr 2023Evidence →
22. High, CVSS 7.726 Apr 2023

    Arbitrary file read via SQL injection

    Packagist prestashop/prestashop · Upgrade to 8.0.4 or 1.7.8.9 by release line · >= 8.0.0, < 8.0.4; < 1.7.8.9 · CVE-2023-30545 · GHSA-8r4m-5p6p-52rp

    26 Apr 2023Evidence →
23. High, CVSS 7.526 Apr 2023

    Improper input validation in Drupal core

    Packagist drupal/core · Upgrade to 9.3.12 or 9.2.18 by release line · >= 8.0.0, < 9.2.18; >= 9.3.0, < 9.3.12 · CVE-2022-25273 · GHSA-g36h-4jr6-qmm9

    26 Apr 2023Evidence →
24. High, CVSS 7.025 Apr 2023

    Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer

    Go github.com/apptainer/apptainer · Upgrade to 1.1.8 or later · < 1.1.8 · CVE-2023-30549 · GHSA-j4rf-7357-f4cg

    25 Apr 2023Evidence →
25. High, CVSS 8.225 Apr 2023

    HTML injection in search results via plaintext message highlighting

    npm matrix-react-sdk · Upgrade to 3.71.0 or later · < 3.71.0 · CVE-2023-30609 · GHSA-xv83-x443-7rmw · amended

    25 Apr 2023Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.