GitHub

Impact
What kind of vulnerability is it? Who is impacted?
Anyone parsing JSON from an untrusted source is vulnerable.
JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corruptin…

Impact
What kind of vulnerability is it? Who is impacted?
When an error occurs while reallocating the buffer for string decoding, the buffer gets freed twice.
Due to how UltraJSON uses the internal decoder, this double free is impossible to trigger fro…

Impact
A YAML deserialization in opensearch-ruby 2.0.0 can lead to unsafe deserialization using YAML.load if the response is of type YAML.
Patches
The problem has been patched in opensearch-ruby gem version 2.0.2.
Workarounds
No viable workaround. Ple…

An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted CSS selectors.
The followin…

Cross-site Scripting (XSS) – Stored in GitHub repository microweber/microweber prior to 1.2.19.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-2300
https://github.com/microweber/microweber/commit/70b46e231e7b2c113666745a0ab6de9a8b7ef08e
https://…

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and k…

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption wil…

Cross-site Scripting (XSS) – Stored in GitHub repository microweber/microweber prior to 1.2.19.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-2280
https://github.com/microweber/microweber/commit/9ebbb4dd35da74025ab6965f722829a7f8f86566
https://…

All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the –upload-pack feature of git.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-25900
https://gist.github.com/lirantal/9441f3a1212728476f7a6caa4acb2c…

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-25896
https://github.com/jaredhanson/passport/pull/900
https://gi…