Skip to content
OpenAdvisories

Archive

6 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /6 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-27922

    HTTP Handling Vulnerability in the Bare server

    TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of…

    tomphttp bare-server-node @tomphttp/bare-server-node npm
  • Critical 9.8
    CVE-2024-27307

    JSONata expression can pollute the "Object" prototype

    JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denia…

    jsonata-js jsonata renovate jsonata Wolfi npm
  • Critical 9.8
    CVE-2024-27304 Public exploit

    pgx SQL Injection via Protocol Message Size Overflow

    pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple me…

    jackc pgx kots k3s Debian Ubuntu Azure Linux Wolfi Go
  • Critical 9.1
    CVE-2024-27302

    Authorization Bypass Through User-Controlled Key in go-zero

    go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads t…

    zeromicro go-zero github.com/zeromicro/go-zero Go
  • Critical 9.1
    CVE-2024-24767

    CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability

    CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lac…

    IceWhale Tech CasaOS-UserService github.com/IceWhaleTech/CasaOS-UserService Go
  • Critical 9.7
    CVE-2023-50716

    Invalid DATA_FRAG Submessage causes a bad-free error

    eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Prior to versions 2.13.0, 2.12.2, 2.11.3, 2.10.3, and 2.6.7, an invalid DATA_FRAG Submessage causes a bad-free error, and …

    eProsima Fast-DDS fastdds fastdds Debian Ubuntu
  • Critical 9.1
    CVE-2024-26580

    Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

    Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or …

    Apache Software Foundation Apache InLong org.apache.inlong:manager-common Maven
  • Critical 9.1
    CVE-2020-26942

    An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated a…

  • Critical 9.8
    CVE-2023-38825

    SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive informati…