CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: fixuid, dfc, gotestsum, falcosidekick-fips, openbao-k8s, sonobuoy-fips, sonobuoy, yunikorn-web, rancher-telemetry, vault-env, terraform-provider-azapi, cluster-api, kafka-proxy, kubeflow, cluster-proportional-autoscaler-fips, prometheus-elasticsearch-exporter,...

EUVD-2024-2702

Malicious code in bioql PyPI...

EUVD-2025-4517

Malicious code in bioql PyPI...

EUVD-2021-27702

Malicious code in bioql PyPI...

EUVD-2022-28108

Malicious code in bioql PyPI...

EUVD-2025-2905

Malicious code in bioql PyPI...

EUVD-2022-0887

Malicious code in bioql PyPI...

EUVD-2022-7534

Malicious code in bioql PyPI...

EUVD-2022-0971

Malicious code in bioql PyPI...

EUVD-2025-12479

Malicious code in bioql PyPI...

EUVD-2025-5047

Malicious code in bioql PyPI...

EUVD-2024-39195

Malicious code in bioql PyPI...

org.lucee:aws-sm (>=1.0.0.5-rc, <=1.1.0.4-rc), org.lucee:chart (>=3.0.0.0-beta, <=3.0.0.1-beta) +12 more potentially affected by CVE-2025-34074 via org.lucee:lucee (>=6.1.1.118, <=7.1.0.2-alpha)

org.lucee:lucee MAVEN version =6.1.1.118, =1.0.0.5-rc, =3.0.0.0-beta, =1.0.0.0-alpha, =1.0.0.0-alpha, =3.0.0.0-alpha, =1.0.0.17-beta, =3.0.0.0-beta, =2.1.0.0-beta, =1.0.0.2-rc, =1.0.0.3-rc Source cves: CVE-2025-34074 Source advisory: SNYK:JAVA-ORGLUCEE-10587798...

CVE-2024-28823

Amazon AWS aws-js-s3-explorer aka AWS JavaScript S3 Explorer 1.0.0 allows XSS via a crafted S3 bucket name to index.html...

CVE-2024-41806

The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts in the instructor dashboard. These files are uploaded using the django default storage. With certain storage backends, uploads may become publicly available...

CVE-2022-22997

Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices...

CVE-2025-46655

CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted...

CVE-2025-46655

CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted...

CVE-2025-46655

CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted...

CVE-2025-46655

CVE-2025-46655 affects CodiMD up to version 2.5.4. The issue is a bypass of the CSP-based XSS protection for SVG uploads when using cross-origin file storage (e.g., AWS S3) in configurations where the architecture cannot insert Content-Security-Policy headers. This can allow XSS in certain storag...