LOW

Vulnerability type
Data Exposure
Workarounds
The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure. The …

Vulnerability type
Authentication
Workarounds
Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.
Detail
The gateway only authenticates endpoints detected from…

Impact
Setting $secure or $httponly value to true in Config\Cookie is not reflected in set_cookie() or Response::setCookie().

Note
This vulnerability does not affect session cookies.

The following code does not issue a cookie with the secure flag eve…

Summary
The rubygem sqlite3 v1.5.1 upgrades the packaged version of libsqlite from v3.39.3 to v3.39.4.
libsqlite v3.39.4 addresses a vulnerability described as follows in the release notification:

Version 3.39.4 is a minimal patch against the prior re…

rdiffweb prior to version 2.4.8 is vulnerable to Improper Cleanup on Thrown Exception. This could allow an attacker to display a message of their choice onto a web page. Version 2.4.8 contains a fix for this issue.
References

https://nvd.nist.gov/vuln…

OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a .gcod…

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 – 3.6.6, 3.7.0 – 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP re…

Impact
Validation of the authentication adapter app ID for Facebook and Spotify may be circumvented.
This fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for Facebook or …

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.
The vulnerability is determined to be low…

WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h.
References

https://nvd.nist.gov/vuln/detail/CVE-2022-39974
https://github.com/wasm3/wasm3/issues/379
https://github.com/wasm3/wa…