CVE-2020-22882

Issue was discovered in the fxParserTree function in moddable, allows attackers to cause denial of service via a crafted payload. Fixed in commit 723816ab9b52f807180c99fc69c7d08cf6c6bd61...

CVE-2018-1000660

TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b85d contains a Insecure Permissions vulnerability in Function getpackagename in the file kernel/src/tbfheader.rs, variable "pub packagename: &'static str," in the file process.r...

RUSTSEC-2025-0062 Heap Buffer Overflow in the DrainCol Destructor

An off-by-one error in the DrainCol::drop destructor could cause an unsafe memory copy operation to exceed the bounds of the associated vector. The error was related to the size of the data being copied in one of the ptr::copy invocations inside the destructor. When removing the first column from...

CVE-2019-15734

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these...

CVE-2018-1000618

EOSIO/eos eos version after commit f1545dd0ae2b77580c2236fdb70ae7138d2c7168 contains a stack overflow vulnerability in abiserializer that can result in attack eos network node. This attack appear to be exploitable via network request. This vulnerability appears to have been fixed in after commit...

CVE-2019-6794

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure issue 5 of 6. A project guest user can view the last commit status of the default branch...

CVE-2019-1010176

JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execution. The component is: function litchartoutf8bytes jerry-core/lit/lit-char-helpers.c:377. The attack vector is: executing crafted...

org.arquillian.cube:arquillian-cube-openshift (>=1.0.0.alpha9, <=1.18.2), org.arquillian.universe:arquillian-cube-openshift (>=1.0.0.alpha3, <=1.0.0.alpha4) +10 more potentially affected by CVE-2025-4949 via org.eclipse.jgit:org.eclipse.jgit (4.0.0.201506090130-r)

org.eclipse.jgit:org.eclipse.jgit MAVEN version 4.0.0.201506090130-r is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jgit:org.eclipse.jgit and may be impacted: - org.arquillian.cube:arquillian-cube-openshift =1.0.0.alpha9, =1.0.0.alpha3,...

CVE-2025-47942

The CVE-2025-47942 entry describes a vulnerability in the Open edX Platform (edxapp) where, prior to commit 6740e75c0fdc7ba095baf88e9f5e4f3e15cfd8ba, there was no built-in protection to prevent downloading the python_lib.zip asset from courses. This could allow access to custom grading code or co...

CVE-2025-48064

GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network...

CVE-2025-48064 GitHub Desktop vulnerable to maliciously crafted file renames leading to information disclosure

GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network...

CVE-2025-48064 GitHub Desktop vulnerable to maliciously crafted file renames leading to information disclosure

GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network...

AZL-61967 CVE-2024-23337 affecting package jq for versions less than 1.6-3

jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue...

CVE-2025-47784

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

aiobook (0.1.0), carml (18.4.0) +5 more potentially affected by CVE-2025-47273 via setuptools (40.6.2)

setuptools PYPI version 40.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - aiobook 0.1.0 - carml 18.4.0 - chaostoolkit 1.0.0rc1 - chaostoolkit-lib 1.0.0rc1 - commit-helper 3.4.13 - commit-helper-testing 3.4.8 -...

CVE-2025-47929

DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload...

CVE-2025-47784

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

UBUNTU-CVE-2025-47928

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

CVE-2025-47929 DumbDrop vulnerable to DOM XSS via file upload

DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability in the upload functionality prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file with a malicious payload...

CVE-2025-47929

CVE-2025-47929 : DumbDrop has a DOM-based cross-site scripting vulnerability in the upload functionality present before commit db27b25372eb9071e63583d8faed2111a2b79f1b. A user could be tricked into uploading a file containing a malicious payload, enabling/script injection in the browser context. ...