GitHub

Impact
The malicious user is able to update a crafted config file into repository’s .git directory with to gain SSH access to the server. All installations with repository upload enabled (default) are affected.
Patches
Repository file updates are prohi…

Impact
The malicious user is able to upload a crafted config file into repository’s .git directory with to gain SSH access to the server. All Windows installations with repository upload enabled (default) are affected.
Patches
Repository file uploads a…

Impact
The malicious user is able to upload a crafted config file into repository’s .git directory with to gain SSH access to the server. All Windows installations with repository upload enabled (default) are affected.
Patches
Repository file uploads a…

Impact
There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self.
Patches
Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the lates…

Impact
Waitress may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed.
Patch…

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.
References

https://github.co…

Impact
npm pack ignores root-level .gitignore & .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. –workspaces, –workspace=<name>). Anyone who has run npm pack or npm publish with workspaces, as of v7…

Impact
All of the source code, files, and folders in phoenix_files/extensions/ are available to end users through a simple HTTP GET request.
Patches
The issue has been patched. The users of version 1.0.6 and above are not effected.
References

https://…

Impact
CSRF vulnerability allowing attackers to change the state of an order’s adjustments if they hold its number, and the execution happens on a store administrator’s computer.
Reproduction steps:

Take an order’s number.
Log in as an administrator.
…

Impact
We found a possible XSS vector in the Filter.FilterStreamDescriptorForm wiki page related to pretty much all the form fields printed in the home page of the application.
Patches
The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10…