File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.

## Impact

The vulnerability, known as RUSTSEC-2022-0093, impacts the `ed25519-dalek` crate, which is a dependency of the `rusty-paseto` crate. This issue arises from a "Double Public Key Signing Function Oracle Attack" affecting versions of `ed25519-dalek` prior to v2.0. These versions expose an unsafe API for serializing and deserializing 64-byte keypairs that include both private and public keys, creating potential for certain attacks. `d25519-dalek` users utilizing these serialization and deserialization functions directly could potentially be impacted. 

## Patches

The vulnerability within the `ed25519-dalek` crate has been addressed in version 2.0. `rusty-paseto` has addressed it in release v0.6.0. 

## Workarounds

Users are recommended to upgrade to v0.6.0 of `rusty-paseto`. However, users should still ensure that their key serialization and deserialization practices are secure and avoid any practices that could lead to key exposure.

## References

More information about RUSTSEC-2022-0093 can be found in the [RustSec Advisory Database](https://rustsec.org/advisories/RUSTSEC-2022-0093.html). Updates and details regarding the upcoming release of `rusty-paseto` will be documented in the project's [releases](https://github.com/your-repo/rusty-paseto/releases) and [changelog](https://github.com/your-repo/rusty-paseto/blob/main/CHANGELOG.md).  This issue was first reported by Dependabot on 2023-08-15. The source was reviewed by @rrrodzilla at that time and a determination was made that the vulnerability low harm to existing users due to the strongly typed nature of keys provided by the rusty-paseto API. @techport-om reported the vulnerability to the repository by discovering during a `cargo-audit` run on 2023-11-05 and opened [issue 28](https://github.com/rrrodzilla/rusty_paseto/issues/28). This advisory was created at that time to notify existing users.


Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service.

### Impact

Mutagen projects offer shell-based execution functionality.  On Windows, the shell is resolved using the standard `%ComSpec%` mechanism, with a fallback to a `%PATH%`-based search for `cmd.exe`.  While this is the standard practice on Windows systems, it presents somewhat risky behavior.

Firstly, `%ComSpec%` could, in theory, be set maliciously.  Unfortunately, there's not much that can be done to prevent this attack surface, because `%ComSpec%` is the official mechanism for shell specification on Windows.  We can, however, validate that it points to an absolute path, which one would expect for a properly set value.

Secondly, a fallback to a relative `cmd.exe` path, resolved via `%PATH%`, could be risky.  The risk is largely mitigated by changes in Go 1.19 and later, but prior to that a malicious `cmd.exe` could been resolved in the current working directory.  To mitigate this issue, Mutagen now uses the `%SystemRoot%` environment variable (also validated to be an absolute path) to resolve `cmd.exe` in the event that `%ComSpec%` is not set correctly.


### Patches

The problem has been patched in Mutagen v0.16.6 and v0.17.1. Earlier versions of Mutagen are no longer supported and will not be patched. Versions of Mutagen after v0.18.0 will also have the patch merged.


### Workarounds

Maintain control of the environment variable settings on your system, in particular the `ComSpec` environment variable.

### References

More information on `%ComSpec%` can be found [online](https://en.wikipedia.org/wiki/COMSPEC).

More information on Go's `PATH`-based lookup changes can be found [here](https://go.dev/blog/path-security), [here](https://go.dev/doc/go1.19#os-exec-path), and [here](https://github.com/golang/go/issues/43947).

A [similar issue](https://github.com/python/cpython/issues/101283) that was addressed within the Python subprocess module also provides additional discussion.


Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php.

FLVMeta v1.2.1 was discovered to contain a buffer overflow via the xml_on_metadata_tag_only function at dump_xml.c.

A cross-site request forgery vulnerability in this package can allow an attacker to inject arbitrary values and forge malicious requests on behalf of a user. The attacker may inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application.

The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. For 'safe' methods, the token is extracted from the cookie and saved to storage without further validation or sanitization. In addition, the CSRF token is validated against tokens in storage but not associated with a session, nor by using a Double Submit Cookie Method, allowing for token reuse.

The implementation of the [`Instrumented::into_inner`] method in affected
versions of this crate contains undefined behavior due to incorrect use of
[`std::mem::forget`] The function creates `*const` pointers to `self`, calls
[`mem::forget(self)`][`std::mem::forget`], and then moves values out of those
pointers using [`std::ptr::read`].

```rust
// To manually destructure `Instrumented` without `Drop`, we
// move it into a ManuallyDrop and use pointers to its fields
let span: *const Span = &this.span;
let inner: *const ManuallyDrop<T> = &this.inner;
mem::forget(self);
// SAFETY: Those pointers are valid for reads, because `Drop` didn't
//         run, and properly aligned, because `Instrumented` isn't
//         `#[repr(packed)]`.
let _span = unsafe { span.read() };
let inner = unsafe { inner.read() };
```

However, the [`mem::forget` documentation][`std::mem::forget`] states:

> Any resources the value manages, such as heap memory or a file handle, will
> linger forever in an unreachable state. **However, it does not guarantee that
> pointers to this memory will remain valid.**

This means that these pointers are no longer valid. This could result in a stack
use-after-free if LLVM chooses to reuse `self`'s stack slot for a rebinding
after the call to [`std::mem::forget`].

This undefined behavior has not been observed to cause miscompilation as of Rust
1.73.0. However, any use of this method with the affected versions of `tracing`
are unsound.

The flaw was corrected in commit [20a1762] ([PR #2765]) by replacing the use of
[`std::mem::forget`] with `std::mem::ManuallyDrop`, ensuring that the stack slot
is not reused and the pointers remain valid when they are read. The fix is
published in `tracing` [v0.1.40]. Affected versions have been yanked from
crates.io.

Thanks to [Taylor Cramer] and [Manish Goregaokar] for finding and correcting
this issue!

[`Instrumented::into_inner`]:
    https://docs.rs/tracing/latest/tracing/instrument/struct.Instrumented.html#method.into_inner
[`std::mem::forget`]: https://doc.rust-lang.org/std/mem/fn.forget.html
[`std::ptr::read`]:
    https://doc.rust-lang.org/std/primitive.pointer.html#method.read-1
[20a1762]:
    https://github.com/tokio-rs/tracing/commit/20a1762b3fd5f1fafead198fd18e469c68683721
[PR #2765]: https://github.com/tokio-rs/tracing/pull/2765
[v0.1.40]: https://crates.io/crates/tracing/0.1.40
[Taylor Cramer]: https://github.com/cramertj
[Manish Goregaokar]: https://github.com/manishearth

An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated() that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). Affected OpenNDS Captive Portal before version 10.1.2 fixed infixed in OpenWrt master, OpenWrt 23.05 and OpenWrt 22.03 on28. August 2023 by updating OpenNDS to version 10.1.3.

gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve, if the degree of each term in the polynomial is not strictly decreasing.

### Impact
Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.

### Patches
 The issue has been patched in [`v1.4.0`](https://github.com/edgelesssys/marblerun/releases/tag/v1.4.0)

### Workarounds

Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.


libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_hevc_epel_pixels_8_sse function at sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input file.

** UNSUPPPORTED WHEN ASSIGNED **** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this vulnerability is an unknown functionality of the component Lookup Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.9.2 is able to address this issue. The name of the patch is 5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3. It is recommended to upgrade the affected component. The identifier VDB-217441 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php.

### Summary

The `runTailscalePing` method of the `TailscalePing` class injects the `hostname` parameter inside a shell command, leading to a command injection and the possibility to run arbitrary commands on the server.

### Details

When adding a new monitor on Uptime Kuma, we can select the "Tailscale Ping" type. Then we can add a hostname and insert a command injection payload into it. The front-end application requires that the field follow a specific pattern, this validation only happens on the front-end and can be removed by removing the attribute `pattern` on the `input` element.

https://github.com/louislam/uptime-kuma/blob/dc4242019331e65a79ac16deef97510144e01b12/server/monitor-types/tailscale-ping.js#L40-L46

We can finally add the new monitor and observe that our command is being executed.

**NOTE:** When using Uptime Kuma inside a container, the "TailScale Ping" type is not visible. We can fake this information by intercepting WebSocket messages and set the `isContainer` option to `false`.

### PoC

* Authenticate.
* Create a new monitor.
* Select the TailScale Ping type (if not visible, see the note in the details section).
* Insert the command injection payload inside the `hostname` field. (for example `$(id >&2)`)
* Remove the `pattern` requirement on the field.
* Save and start the monitor.

### Impact

An authenticated user can execute arbitrary command on the server running Uptime Kuma.

### Remediation

There are other command execution in the codebase, they use a method `spawn` from the `child_process` module which does not interpret the command as a shell command, the same thing should be done here.

**NOTE:** The Tailscale CLI seems to support the `--` sequence. It should be used between the `ping` subcommand and the `hostname` argument to avoid argument injection.

The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet.

Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls.

The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python).

A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads.

An attacker can send HTTP/2 requests, cancel them, and send subsequent requests. This is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit, grpc.MaxConcurrentStreams. This results in a denial of service due to resource consumption.

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that untrusted user input would reach the code location where injection must occur.

### Context
Content Security Policies (CSP) are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack.

### Impact
There aren't any XSS attack vectors via the Apollo Server landing pages _known to Apollo_, so to our knowledge there is no impact. However, if there are existing XSS vectors that haven't been reported and patched, then all users of Apollo Server's landing pages have a vulnerability which won't be prevented by the current CSP implemented by the landing pages.

Prior to version 4.7.1, there was no CSP implemented at all. However, the initial CSP implementation (4.7.1+) reused nonces. While this sufficiently resolved the issue w.r.t. scripts not running in Safari, it did not implement CSP in a safe or conventional way.

### Patches
The issue is patched in the latest version of Apollo Server, v4.7.4. The changes can be reviewed in [the merge commit](https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c).

### Workarounds
The landing page can be disabled completely until the patch can be upgraded to.
https://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#disabling-the-landing-page

### References
https://content-security-policy.com/nonce/

A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.

Timing attack from non-constant time scalar arithmetic in github.com/bnb-chain/tss-lib.

An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.

A malicious user can send a REST request to a List endpoint with filters that contain custom SQL statements. This can result in SQL injection.

An issue in the box_add function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.

A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.

This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in build.rs to exfiltrate host information to the attacker.

This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available. The related malicious crates have been yanked, and the malicious account has been banned.

Thanks to [Veracode](https://www.veracode.com/) (formerly phylum)for
reporting this to the crates.io team!

Headscale through 0.22.3 writes bearer tokens to info-level logs.

SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list.

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php.

The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on the admin panel.

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.

With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

Given the function `transpose::transpose`:
```rust
fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize)
```

The safety check `input_width * input_height == output.len()` can fail due to `input_width * input_height` overflowing in such a way that it equals `output.len()`.
As a result of failing the safety check, memory past the end of `output` is written to. This only occurs in release mode since `*` panics on overflow in debug mode.

Exploiting this issue requires the caller to pass `input_width` and `input_height` arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.

This crate was part of a typosquatting malware cluster published by the
malicious user `http-tiny` and contained a malware payload in `build.rs` to
exfiltrate host information to the attacker.

This advisory is to retrospectively document this attempted attack. The version
information and download records of the malicious crate are no longer
available. The related malicious crates have been yanked, and the malicious
account has been banned.

Thanks to Louis Lang at [Phylum] (now [Veracode]) for reporting this malware
campaign.

[Phylum]: https://phylum.io/
[Veracode]: https://www.veracode.com/

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt, https://www.openssl.org/news/secadv/20230719.txt, and https://www.openssl.org/news/secadv/20230714.txt.

If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

`RUSTSEC-2024-0377` contains multiple soundness issues:

 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)
 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)
 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)
 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)
 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)

Version 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.

### Summary
llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities.
Details have not been disclosed yet, so refer to llhttp for future information.
The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).

Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.


An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php

please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl. (If both TIOCSTI and TIOCLINUX are disabled, this cannot be exploited.)

VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html.

async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in ReceiveFrom and Receive in udpsocket.hpp when processing malformed UDP packets.

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo.

This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.

Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function.

An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquantize.c.

### Summary

`slsa-verifier<=2.4.0` does not correctly verify npm's [publish](https://github.com/npm/attestation/tree/main/specs/publish/v0.1) attestations signature.

### Proof of concept

Steps to reproduce:
1. `curl -Sso attestations.json $(npm view @trishankatdatadog/supreme-goggles --json | jq -r '.dist.attestations.url')`
2. `curl -Sso supreme-goggles.tgz "$(npm view @trishankatdatadog/supreme-goggles --json | jq -r '.dist.tarball')"`
3. In `attestations.json`, take the value addressed by the `jq` selector `.attestations[0].bundle.dsseEnvelope.payload`, base64decode it, tamper with it, base64encode that, and replace the original value with that. Save the file as `attestations_tampered.json`.
   Here is an example command to replace the package name with `@attacker/malicious`:
   `jq -r ".attestations[0].bundle.dsseEnvelope.payload = \"$(jq -r '.attestations[0].bundle.dsseEnvelope.payload | @base64d' < attestations.json | jq '.subject[0].name = "pkg:npm/%40attacker/malicious"' | base64 -w0)\"" < attestations.json > attestations_tampered.json`
5. `SLSA_VERIFIER_EXPERIMENTAL=1 slsa-verifier verify-npm-package supreme-goggles.tgz --attestations-path attestations_tampered.json --builder-id "https://github.com/actions/runner/github-hosted" --package-name "@trishankatdatadog/supreme-goggles" --package-version 1.0.5 --source-uri github.com/trishankatdatadog/supreme-goggles`
6. The result is that `slsa-verifier` fails to detect this tampering of the publish attestation (unlike with the provenance attestation) and returns `PASSED`.

### Impact

An attacker who controls what packages and attestations are shown to a user _can_ associate a package with an arbitrary name and version that do _not_ match what the user expects from the publish attestation. Furthermore, the package digest in the publish attestation need _not_ match its counterpart in the provenance attestation. However, the attacker _cannot_ associate the given package with an arbitrary source and builder that the user does not expect from the provenance attestation. Thus, the attacker could, for example, convince package managers to install authentic but older versions of packages that contain known, exploitable vulnerabilities.

Severity is considered low because 1) it does not invalidate the provenance and 2) support for npm is currently experimental.

### Patches

Fixed by PR [#705](https://github.com/slsa-framework/slsa-verifier/pull/705) and released in versions `>=2.4.1`.

### Workarounds

There is no easy way for users to fix or remediate this vulnerability without upgrading, short of verifying npm's publish attestations themselves, _and_ cross-verifying it against GHA's provenance attestations.

### References

* [Original OpenSSF Slack thread](https://openssf.slack.com/archives/C03PDLFET5W/p1695330038983179)


link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.

CVE ID↕	Published↕	CVSS↓
CVE-2023-38836	Aug 21, 2023	N/A
DLA-3650-1	Nov 12, 2023	N/A
GHSA-j57r-4qw6-58r3	Nov 7, 2023	N/A
CVE-2023-38667	Aug 22, 2023	N/A
DLA-3568-1	Sep 16, 2023	N/A
GHSA-fwj4-72fm-c93g	May 5, 2023	N/A
CVE-2022-41444	Aug 22, 2023	N/A
DSA-5560-1	Nov 20, 2023	N/A
DLA-3562-1	Sep 12, 2023	N/A
CVE-2023-36243	Jun 22, 2023	N/A
GO-2023-2115	Oct 24, 2023	N/A
RUSTSEC-2023-0078	Oct 19, 2023	N/A
CVE-2023-28873	Dec 9, 2023	N/A
CVE-2023-38314	Nov 17, 2023	N/A
CVE-2023-50980	Dec 18, 2023	N/A
GHSA-j3rq-4xjw-xg63	Dec 4, 2023	N/A
CVE-2023-24752	Mar 1, 2023	N/A
DSA-5496-1	Sep 13, 2023	N/A
PYSEC-2023-14	Jan 5, 2023	N/A
CVE-2023-46865	Oct 30, 2023	N/A
CVE-2023-38767	Aug 8, 2023	N/A
GHSA-hfxh-rjv7-2369	Nov 27, 2023	N/A
CVE-2023-1801	Apr 7, 2023	N/A
CVE-2023-41260	Nov 3, 2023	N/A
CVE-2023-33290	Jun 12, 2023	N/A
CVE-2023-28485	Jun 26, 2023	N/A
GO-2023-2153	Nov 1, 2023	N/A
CVE-2023-39017	Jul 28, 2023	N/A
GHSA-68jh-rf6x-836f	Jun 16, 2023	N/A
CVE-2023-39001	Aug 9, 2023	N/A
GO-2023-1733	Jul 11, 2023	N/A
DSA-5515-1	Oct 4, 2023	N/A
CVE-2023-31489	May 9, 2023	N/A
GO-2023-2162	Nov 2, 2023	N/A
CVE-2023-48949	Nov 29, 2023	N/A
CVE-2023-45957	Dec 22, 2023	N/A
DLA-3676-1	Nov 30, 2023	N/A
RUSTSEC-2023-0098	Aug 16, 2023	N/A
CVE-2023-47390	Nov 11, 2023	N/A
CVE-2023-46981	Nov 4, 2023	N/A
CVE-2023-38768	Aug 8, 2023	N/A
DLA-3372-1	Mar 29, 2023	N/A
CVE-2023-36211	Aug 1, 2023	N/A
CVE-2023-45857	Nov 8, 2023	N/A
GO-2023-2102	Oct 11, 2023	N/A
DLA-3531-1	Aug 16, 2023	N/A
RUSTSEC-2023-0080	Dec 18, 2023	N/A
PYSEC-2023-226	Nov 3, 2023	N/A
PSF-2023-2	Apr 18, 2023	N/A
DSA-5564-1	Nov 24, 2023	N/A
CVE-2023-2007	Apr 24, 2023	N/A
RUSTSEC-2023-0114	Nov 6, 2023	N/A
GHSA-jm77-qphf-c4w8	Aug 1, 2023	N/A
RUSTSEC-2023-0086	Sep 3, 2023	N/A
GHSA-pjjw-qhg8-p2p9	Nov 27, 2023	N/A
PYSEC-2023-76	May 8, 2023	N/A
CVE-2023-41005	Aug 28, 2023	N/A
CVE-2023-46277	Oct 20, 2023	N/A
CVE-2023-35849	Jun 19, 2023	N/A
DLA-3654-1	Nov 17, 2023	N/A
CVE-2023-37302	Jun 30, 2023	N/A
DLA-3671-1	Nov 28, 2023	N/A
DLA-3379-1	Apr 1, 2023	N/A
CVE-2023-22975	Feb 3, 2023	N/A
CVE-2023-40296	Aug 14, 2023	N/A
GO-2023-1839	Jun 8, 2023	N/A
DSA-5456-1	Jul 20, 2023	N/A
PYSEC-2023-92	Jun 20, 2023	N/A
DLA-3357-2	Mar 18, 2023	N/A
DLA-3639-1	Oct 30, 2023	N/A
CVE-2023-24206	Feb 27, 2023	N/A
CVE-2023-42298	Oct 12, 2023	N/A
DSA-5323-1	Jan 19, 2023	N/A
GHSA-r2xv-vpr2-42m9	Nov 8, 2023	N/A
CVE-2023-46303	Oct 22, 2023	N/A

Know every vulnerability
before it knows you.

2023 CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

2023 CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.