HIGH

Impact
The general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories:
if (!fs->Match(child_path, dirs[dir_index])) { … }

Since dir_index is unconditional…

This affects all versions of package github.com/russellhaering/goxmldsig prior to 1.1.1. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. This issue is patched in version 1.1.1.
References

https://nvd.nist.gov/vu…

Impact
For applications using JWT or session-based authentication (not OIDC), users can input a login string which can cause a denial of service, as parsing it will be too complex.
Here is an example: https://gist.github.com/atomfrede/311f8a9c6eb74c5c5…

Impact
Arbitrary additional email headers can be injected via crafted From or Sender headers.
Patches
Fixed in 2.2.1
Workarounds
Filter user-supplied values prior to using them in From or Sender properties.
References
https://nvd.nist.gov/vuln/detail/C…

rdiffweb prior to 2.5.0a4 does not have a rate limit to prevent attackers attempting brute force attacks to guess passwords. Version 2.5.0a4 limits the number of incorrect password attempts.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-3273
ht…

rdiffweb prior to 2.4.10 is vulnerable to Path Traversal. Version 2.4.10 contains a patch.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-3389
https://github.com/ikus060/rdiffweb/commit/323383d1db656f1b1291be529947bd943a6b0e99
https://huntr.dev/…

Impact
Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet.
In an effort to make enabling authentication easier for Flyte administrators, the default configuratio…

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-38817
https://github.com/dapr/dashboard/issues/222
https://github.com/…

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original d…

In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only wi…