# NuGet Advisories. Every NuGet Advisory we hold (.NET), newest first. ## Records, newest first (an older page) - [Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section](https://agentprime.io/advisories/GHSA-c5g6-6xf7-qxp3.md) `GHSA-c5g6-6xf7-qxp3`, `CVE-2024-47819` · npm `@umbraco-cms/backoffice` and 1 more: affected `>=14.0.0, <14.3.1`, fixed in `14.3.1` · CVSS 4.2 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: Cross-site scripting (XSS) - [Security Update for the OPC UA .NET Standard Stack](https://agentprime.io/advisories/GHSA-7vfh-cqpc-4267.md) `GHSA-7vfh-cqpc-4267`, `CVE-2024-45526` · NuGet `OPCFoundation.NetStandard.Opc.Ua` and 1 more: affected `<1.5.374.118`, fixed in `1.5.374.118` · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2024 · Tags: Denial of service - [Security Update for the OPC UA .NET Standard Stack](https://agentprime.io/advisories/GHSA-qm9f-c3v9-wphv.md) `GHSA-qm9f-c3v9-wphv` · NuGet `OPCFoundation.NetStandard.Opc.Ua` and 1 more: affected `<1.05.374.54`, fixed in `1.05.374.54` · CVSS 7.5 High · Not analysed yet · Published 18 Oct 2024 · Tags: Denial of service - [MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow](https://agentprime.io/advisories/GHSA-4qm4-8hg2-g2xm.md) `GHSA-4qm4-8hg2-g2xm`, `CVE-2024-48924` · NuGet `MessagePack`: affected `<2.5.187 || >=2.6.95-alpha, <3.0.214-rc.1`, fixed in `2.5.187`, `3.0.214-rc.1` · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2024 · Tags: Weak cryptography or TLS - [Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-8g4q-xg66-9fp4.md) `GHSA-8g4q-xg66-9fp4`, `BIT-dotnet-2024-43485`, `BIT-dotnet-sdk-2024-43485`, `CVE-2024-43485` · NuGet `System.Text.Json`: affected `>=6.0.0, <6.0.10 || >=8.0.0, <8.0.5`, fixed in `6.0.10`, `8.0.5` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 · Tags: Denial of service - [Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-f32c-w444-8ppv.md) `GHSA-f32c-w444-8ppv`, `BIT-dotnet-2024-43484`, `BIT-dotnet-sdk-2024-43484`, `CVE-2024-43484` · NuGet `System.IO.Packaging`: affected `>=6.0.0-preview.1.21102.12, <6.0.1 || >=8.0.0-preview.1.23110.8, <8.0.1 || >=9.0.0-preview.1.24080.9, <9.0.0-rc.2.24473.5`, fixed in `6.0.1`, `8.0.1`, `9.0.0-rc.2.24473.5` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 · Tags: Denial of service - [Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-qj66-m88j-hmgj.md) `GHSA-qj66-m88j-hmgj`, `BIT-dotnet-2024-43483`, `BIT-dotnet-sdk-2024-43483`, `CVE-2024-43483` · NuGet `Microsoft.Extensions.Caching.Memory` and 2 more: affected `>=6.0.0-preview.1.21102.12, <6.0.2 || >=8.0.0-preview.1.23110.8, <8.0.1 || >=9.0.0-preview.1.24080.9, <9.0.0-rc.2.24473.5`, fixed in `6.0.2`, `8.0.1`, `9.0.0-rc.2.24473.5` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 · Tags: Denial of service - [Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-7vw9-cfwx-9gx9.md) `GHSA-7vw9-cfwx-9gx9`, `BIT-dotnet-2024-38229`, `BIT-dotnet-sdk-2024-38229`, `CVE-2024-38229` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.10 || >=9.0.0-preview.1.24081.5, <9.0.0-rc.2.24474.3`, fixed in `8.0.10`, `9.0.0-rc.2.24474.3` · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2024 · Tags: Race condition, Memory corruption - [CRLF Injection in RestSharp's \`RestRequest.AddHeader\` method](https://agentprime.io/advisories/GHSA-4rr6-2v9v-wcpc.md) `GHSA-4rr6-2v9v-wcpc`, `CVE-2024-45302` · NuGet `RestSharp`: affected `>=107.0.0-preview.1, <112.0.0`, fixed in `112.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 29 Aug 2024 · Tags: Other injection - [Serilog Client IP Spoofing vulnerability](https://agentprime.io/advisories/GHSA-5x5q-cqf6-gj8r.md) `GHSA-5x5q-cqf6-gj8r`, `CVE-2024-44930` · NuGet `Serilog.Enrichers.ClientInfo`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.5 Medium · Not analysed yet · Published 29 Aug 2024 · Tags: Cross-site scripting (XSS), CWE-348 - [Umbraco CMS Improper Access Control vulnerability](https://agentprime.io/advisories/GHSA-hrww-x3fq-xcvh.md) `GHSA-hrww-x3fq-xcvh`, `CVE-2024-43377` · NuGet `Umbraco.Cms`: affected `>=14.0.0, <14.1.2`, fixed in `14.1.2` · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Broken access control - [Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information](https://agentprime.io/advisories/GHSA-77gj-crhp-3gvx.md) `GHSA-77gj-crhp-3gvx`, `CVE-2024-43376` · NuGet `Umbraco.Cms.Api.Management`: affected `>=14.0.0, <14.1.2`, fixed in `14.1.2` · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Information disclosure - [Microsoft Security Advisory CVE-2024-38168 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-7qrv-8f9x-3h32.md) `GHSA-7qrv-8f9x-3h32`, `BIT-dotnet-2024-38168`, `BIT-dotnet-sdk-2024-38168`, `CVE-2024-38168` · NuGet `Microsoft.AspNetCore.App.Runtime.win-arm` and 3 more: affected `>=8.0.0, <8.0.8`, fixed in `8.0.8` · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2024 · Tags: Denial of service - [Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-3r34-r6w3-fqp6.md) `GHSA-3r34-r6w3-fqp6`, `BIT-dotnet-2024-38167`, `BIT-dotnet-sdk-2024-38167`, `CVE-2024-38167` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.8`, fixed in `8.0.8` · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2024 · Tags: Weak cryptography or TLS - [IdentityServer Open Redirect vulnerability](https://agentprime.io/advisories/GHSA-55p7-v223-x366.md) `GHSA-55p7-v223-x366` · NuGet `IdentityServer4`: affected `<=4.1.2`, no fixed version yet · CVSS 4.7 Medium · Not analysed yet · Published 31 Jul 2024 · Tags: Open redirect - [IdentityServer Open Redirect vulnerability](https://agentprime.io/advisories/GHSA-ff4q-64jc-gx98.md) `GHSA-ff4q-64jc-gx98`, `CVE-2024-39694` · NuGet `Duende.IdentityServer` and 1 more: affected `>=6.0.0-preview.1, <6.0.5 || >=6.1.0-preview.1, <6.1.8 || >=6.2.0-preview.1, <6.2.5 || >=6.3.0-preview.1, <6.3.10 || >=7.0.0-preview.1, <7.0.6`, fixed in `6.0.5`, `6.1.8`, `6.2.5`, `6.3.10`, `7.0.6` · CVSS 4.7 Medium · Not analysed yet · Published 31 Jul 2024 · Tags: Open redirect - [tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users](https://agentprime.io/advisories/GHSA-c3h4-9gc2-f7h4.md) `GHSA-c3h4-9gc2-f7h4`, `CVE-2024-41799` · NuGet `Tgstation.Server.Api` and 1 more: affected `>=4.0.0, <6.8.0`, fixed in `6.8.0` · CVSS 8.4 High · Not analysed yet · Published 29 Jul 2024 · Tags: Path traversal - [CLSA Directory Traversal vulnerability](https://agentprime.io/advisories/GHSA-9xhh-3m78-gvgj.md) `GHSA-9xhh-3m78-gvgj`, `CVE-2024-28698` · NuGet `Csla`: affected `<5.5.4 || >=6.0.0, <8.0.0 || >=7.0.0, <8.0.0`, fixed in `5.5.4`, `8.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2024 · Tags: Path traversal - [SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder](https://agentprime.io/advisories/GHSA-qxrv-gp6x-rc23.md) `GHSA-qxrv-gp6x-rc23`, `CVE-2024-41132` · NuGet `SixLabors.ImageSharp`: affected `<2.1.9 || >=3.0.0, <3.1.5`, fixed in `2.1.9`, `3.1.5` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2024 · Tags: Denial of service - [SixLabors ImageSharp Out-of-bounds Write](https://agentprime.io/advisories/GHSA-63p8-c4ww-9cg7.md) `GHSA-63p8-c4ww-9cg7`, `CVE-2024-41131` · NuGet `SixLabors.ImageSharp`: affected `<2.1.9 || >=3.0.0, <3.1.5`, fixed in `2.1.9`, `3.1.5` · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2024 · Tags: Memory corruption - [Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error](https://agentprime.io/advisories/GHSA-vmcp-66r5-3pcp.md) `GHSA-vmcp-66r5-3pcp`, `CVE-2024-40636` · NuGet `Steeltoe.Discovery.ClientAutofac` and 3 more: affected `<=2.5.5`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2024 · Tags: Information disclosure - [Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-vc8w-jr9v-vj7f.md) `GHSA-vc8w-jr9v-vj7f`, `CVE-2024-6531` · Maven `org.webjars:bootstrap` and 6 more: affected `>=4.0.0, <5.0.0`, fixed in `5.0.0` · CVSS 6.4 Medium · Withdrawn · Not analysed yet · Published 11 Jul 2024 · Tags: Cross-site scripting (XSS) - [Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-9mvj-f7w8-pvh2.md) `GHSA-9mvj-f7w8-pvh2`, `CVE-2024-6484` · Maven `org.webjars:bootstrap` and 8 more: affected `>=2.0.0, <=3.4.1`, no fixed version yet · CVSS 6.4 Medium · Withdrawn · Not analysed yet · Published 11 Jul 2024 · Tags: Cross-site scripting (XSS) - [Mimekit has vulnerable dependency that can lead to denial of service](https://agentprime.io/advisories/GHSA-gmc6-fwg3-75m5.md) `GHSA-gmc6-fwg3-75m5` · NuGet `MimeKit`: affected `>=3.0.0, <4.7.1`, fixed in `4.7.1` · CVSS 7.5 High · Not analysed yet · Published 11 Jul 2024 · Tags: CWE-20 - [Microsoft Security Advisory CVE-2024-38095 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-447r-wph3-92pm.md) `GHSA-447r-wph3-92pm`, `BIT-dotnet-2024-38095`, `BIT-dotnet-sdk-2024-38095`, `CVE-2024-38095` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 12 more: affected `>=6.0.0, <6.0.32 || >=8.0.0, <8.0.7`, fixed in `6.0.32`, `8.0.7` · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-20 - [Microsoft Security Advisory CVE-2024-38081 | .NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-hq7w-xv5x-g34j.md) `GHSA-hq7w-xv5x-g34j`, `BIT-dotnet-2024-38081`, `BIT-dotnet-sdk-2024-38081`, `CVE-2024-38081` · NuGet `Microsoft.IO.Redist`: affected `>=4.6.0-preview.18571.3, <6.0.1`, fixed in `6.0.1` · CVSS 7.3 High · Not analysed yet · Published 9 Jul 2024 · Tags: Path traversal - [Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-chfc-9w6m-75rf.md) `GHSA-chfc-9w6m-75rf`, `BIT-dotnet-2024-35264`, `BIT-dotnet-sdk-2024-35264`, `CVE-2024-35264` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.7`, fixed in `8.0.7` · CVSS 8.1 High · Not analysed yet · Published 9 Jul 2024 · Tags: Memory corruption - [Microsoft Security Advisory CVE-2024-30105 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-hh2w-p6rv-4g7w.md) `GHSA-hh2w-p6rv-4g7w`, `BIT-dotnet-2024-30105`, `BIT-dotnet-sdk-2024-30105`, `CVE-2024-30105` · NuGet `System.Text.Json`: affected `>=7.0.0, <8.0.4`, fixed in `8.0.4` · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2024 · Tags: Denial of service - [NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities](https://agentprime.io/advisories/GHSA-fg4q-ccq8-3r5q.md) `GHSA-fg4q-ccq8-3r5q`, `CVE-2024-39677` · NuGet `NHibernate`: affected `<5.4.9 || >=5.5.0, <5.5.2`, fixed in `5.4.9`, `5.5.2` · CVSS 5.9 Medium · Not analysed yet · Published 8 Jul 2024 · Tags: SQL injection - [OPCFoundation.NetStandard.Opc.Ua.Core buffer-management vulnerability](https://agentprime.io/advisories/GHSA-4q2p-hwmr-qcxc.md) `GHSA-4q2p-hwmr-qcxc`, `CVE-2024-33862` · NuGet `OPCFoundation.NetStandard.Opc.Ua.Core`: affected `<1.5.374.54`, fixed in `1.5.374.54` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2024 · Tags: Denial of service - [TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option](https://agentprime.io/advisories/GHSA-9hcv-j9pv-qmph.md) `GHSA-9hcv-j9pv-qmph`, `CVE-2024-38356`, `PKSA-kxv7-w7hg-zj9k`, `PYSEC-2026-1301` · npm `tinymce` and 3 more: affected `<5.11.0 || >=6.0.0, <6.8.4 || >=7.0.0, <7.2.0`, fixed in `5.11.0`, `6.8.4`, `7.2.0` · CVSS 6.1 Medium · Not analysed yet · Published 19 Jun 2024 · Tags: Cross-site scripting (XSS) - [TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements](https://agentprime.io/advisories/GHSA-w9jx-4g6g-rp7x.md) `GHSA-w9jx-4g6g-rp7x`, `CVE-2024-38357`, `PKSA-g43k-cp2d-8zny`, `PYSEC-2026-1302` · npm `tinymce` and 3 more: affected `<5.11.0 || >=6.0.0, <6.8.4 || >=7.0.0, <7.2.0`, fixed in `5.11.0`, `6.8.4`, `7.2.0` · CVSS 6.1 Medium · Not analysed yet · Published 19 Jun 2024 · Tags: Cross-site scripting (XSS) - [Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-m5vv-6r4h-3vj9.md) `GHSA-m5vv-6r4h-3vj9`, `CVE-2024-35255`, `GO-2024-2918`, `PYSEC-2026-1209` · Go `github.com/Azure/azure-sdk-for-go/sdk/azidentity` and 7 more: affected `<1.6.0-beta.4.0.20240610221955-50774cd97099`, fixed in `1.6.0-beta.4.0.20240610221955-50774cd97099` · CVSS 5.5 Medium · Not analysed yet · Published 11 Jun 2024 · Tags: Race condition - [Azure Storage Movement Client Library Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-32f8-hmr3-7vxg.md) `GHSA-32f8-hmr3-7vxg`, `CVE-2024-35252` · NuGet `Microsoft.Azure.Storage.DataMovement`: affected `<2.0.5`, fixed in `2.0.5` · CVSS 7.5 High · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-1104 - [Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality](https://agentprime.io/advisories/GHSA-rpj9-xjwm-wr6w.md) `GHSA-rpj9-xjwm-wr6w`, `CVE-2024-35240` · NuGet `Umbraco.Commerce`: affected `<10.0.5 || >=12.0.0, <12.1.4`, fixed in `10.0.5`, `12.1.4` · CVSS 5.4 Medium · Not analysed yet · Published 28 May 2024 · Tags: Cross-site scripting (XSS) - [Umbraco Forms components vulnerable to Stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-p572-p2rj-q5f4.md) `GHSA-p572-p2rj-q5f4`, `CVE-2024-35239` · NuGet `Umbraco.Forms`: affected `>=8.0.0, <8.13.13 || >=10.0.0, <10.5.3 || >=12.0.0, <12.2.2 || >=13.0.0, <13.0.1`, fixed in `8.13.13`, `10.5.3`, `12.2.2`, `13.0.1` · CVSS 2.7 Low · Not analysed yet · Published 28 May 2024 · Tags: Cross-site scripting (XSS) - [Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane](https://agentprime.io/advisories/GHSA-gvpc-3pj6-4m9w.md) `GHSA-gvpc-3pj6-4m9w`, `CVE-2024-35218` · NuGet `UmbracoCms.Core`: affected `>=8.0.0, <8.18.13 || >=10.0.0, <10.8.4 || >=12.0.0, <12.3.7 || >=13.0.0, <13.1.1`, fixed in `8.18.13`, `10.8.4`, `12.3.7`, `13.1.1` · CVSS 4.2 Medium · Not analysed yet · Published 21 May 2024 · Tags: Cross-site scripting (XSS) - [Umbraco CMS Open Redirect Bypass Protection](https://agentprime.io/advisories/GHSA-j74q-mv2c-rxmp.md) `GHSA-j74q-mv2c-rxmp`, `CVE-2024-34071` · NuGet `UmbracoCms.Core` and 1 more: affected `>=8.18.5, <8.18.14 || >=10.5.0, <10.8.6 || >=12.0.0, <12.3.10 || >=13.0.0, <13.3.1`, fixed in `8.18.14`, `10.8.6`, `12.3.10`, `13.3.1` · CVSS 6.1 Medium · Not analysed yet · Published 21 May 2024 · Tags: Open redirect - [Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-hhc7-x9w4-cw47.md) `GHSA-hhc7-x9w4-cw47`, `BIT-dotnet-2024-30046`, `BIT-dotnet-sdk-2024-30046`, `CVE-2024-30046` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 11 more: affected `>=7.0.0, <7.0.19 || >=8.0.0, <8.0.5`, fixed in `7.0.19`, `8.0.5` · CVSS 5.9 Medium · Not analysed yet · Published 14 May 2024 · Tags: Race condition - [Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability](https://agentprime.io/advisories/GHSA-7fcr-8qw6-92fr.md) `GHSA-7fcr-8qw6-92fr`, `BIT-dotnet-2024-30045`, `BIT-dotnet-sdk-2024-30045`, `BIT-powershell-2024-30045`, `CVE-2024-30045` · NuGet `Microsoft.NETCore.App.Runtime.linux-arm` and 11 more: affected `>=7.0.0, <7.0.19 || >=8.0.0, <8.0.5`, fixed in `7.0.19`, `8.0.5` · CVSS 6.3 Medium · Not analysed yet · Published 14 May 2024 · Tags: Memory corruption - [Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-wchx-rm6h-7jf6.md) `GHSA-wchx-rm6h-7jf6`, `CVE-2024-30054` · NuGet `Microsoft.PowerBI.JavaScript`: affected `<=2.23.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2024 · Tags: CWE-20 - [Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")](https://agentprime.io/advisories/GHSA-v435-xc8x-wvr9.md) `GHSA-v435-xc8x-wvr9`, `CVE-2024-30171` · Maven `org.bouncycastle:bcprov-jdk14` and 9 more: affected `<1.78`, fixed in `1.78` · CVSS 5.9 Medium · Not analysed yet · Published 14 May 2024 · Tags: Information disclosure - [Bouncy Castle crafted signature and public key can be used to trigger an infinite loop](https://agentprime.io/advisories/GHSA-m44j-cfrm-g8qc.md) `GHSA-m44j-cfrm-g8qc`, `CVE-2024-30172` · Maven `org.bouncycastle:bcprov-jdk14` and 7 more: affected `>=1.73, <1.78`, fixed in `1.78` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2024 · Tags: Denial of service - [Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.](https://agentprime.io/advisories/GHSA-8xfc-gm6g-vgpv.md) `GHSA-8xfc-gm6g-vgpv`, `CVE-2024-29857` · Maven `org.bouncycastle:bc-fips` and 9 more: affected `<1.0.2.5`, fixed in `1.0.2.5` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2024 · Tags: Memory corruption, Denial of service - [Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow](https://agentprime.io/advisories/GHSA-x9vc-6hfv-hg8c.md) `GHSA-x9vc-6hfv-hg8c`, `CVE-2024-32655` · NuGet `Npgsql`: affected `<4.0.14 || >=4.1.0, <4.1.13 || >=5.0.0, <5.0.18 || >=6.0.0, <6.0.11 || >=7.0.0, <7.0.7 || >=8.0.0, <8.0.3`, fixed in `4.0.14`, `4.1.13`, `5.0.18`, `6.0.11`, `7.0.7`, `8.0.3` · CVSS 8.1 High · Not analysed yet · Published 9 May 2024 · Tags: SQL injection, Memory corruption - [Umbraco Workflow's Backoffice users can execute arbitrary SQL](https://agentprime.io/advisories/GHSA-287f-46j7-j4wh.md) `GHSA-287f-46j7-j4wh`, `CVE-2024-32872` · NuGet `Plumber.Workflow` and 1 more: affected `<10.1.2`, fixed in `10.1.2` · CVSS 5.5 Medium · Not analysed yet · Published 24 Apr 2024 · Tags: SQL injection - [.NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-6qmx-42h2-j8h6.md) `GHSA-6qmx-42h2-j8h6`, `BIT-dotnet-2024-21409`, `BIT-dotnet-sdk-2024-21409`, `BIT-powershell-2024-21409`, `CVE-2024-21409` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `<6.0.29 || >=7.0.0, <7.0.18 || >=8.0.0, <8.0.4`, fixed in `6.0.29`, `7.0.18`, `8.0.4` · CVSS 7.3 High · Not analysed yet · Published 17 Apr 2024 · Tags: Memory corruption - [Blind SSRF Leads to Port Scan by using Webhooks](https://agentprime.io/advisories/GHSA-74p6-39f2-23v3.md) `GHSA-74p6-39f2-23v3`, `CVE-2024-29035` · NuGet `Umbraco.Cms.Core` and 1 more: affected `>=13.0.0, <13.1.1`, fixed in `13.1.1` · CVSS 4.1 Medium · Not analysed yet · Published 17 Apr 2024 · Tags: Server-side request forgery (SSRF) - [MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service](https://agentprime.io/advisories/GHSA-x674-v45j-fwxw.md) `GHSA-x674-v45j-fwxw`, `CVE-2024-27086` · NuGet `Microsoft.Identity.Client`: affected `>=4.48.0, <4.59.1 || >=4.60.0, <4.60.3`, fixed in `4.59.1`, `4.60.3` · CVSS 3.9 Low · Not analysed yet · Published 16 Apr 2024 · Tags: Broken access control, CWE-926 - [SixLabors.ImageSharp vulnerable to data leakage](https://agentprime.io/advisories/GHSA-5x7m-6737-26cr.md) `GHSA-5x7m-6737-26cr`, `CVE-2024-32036` · NuGet `SixLabors.ImageSharp`: affected `<2.1.8 || >=3.0.0, <3.1.4`, fixed in `2.1.8`, `3.1.4` · CVSS 5.3 Medium · Not analysed yet · Published 15 Apr 2024 · Tags: CWE-212, CWE-226 - [SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value](https://agentprime.io/advisories/GHSA-g85r-6x2q-45w7.md) `GHSA-g85r-6x2q-45w7`, `CVE-2024-32035` · NuGet `SixLabors.ImageSharp`: affected `<2.1.8 || >=3.0.0, <3.1.4`, fixed in `2.1.8`, `3.1.4` · CVSS 5.3 Medium · Not analysed yet · Published 15 Apr 2024 · Tags: Denial of service - [Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore](https://agentprime.io/advisories/GHSA-vh2m-22xx-q94f.md) `GHSA-vh2m-22xx-q94f`, `CVE-2024-32028` · NuGet `OpenTelemetry.Instrumentation.AspNetCore` and 1 more: affected `<1.8.1`, fixed in `1.8.1` · CVSS 4.1 Medium · Not analysed yet · Published 12 Apr 2024 · Tags: Information disclosure, CWE-212 - [Azure Identity Library for .NET Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-wvxc-855f-jvrv.md) `GHSA-wvxc-855f-jvrv`, `CVE-2024-29992` · NuGet `Azure.Identity`: affected `<1.11.0`, fixed in `1.11.0` · CVSS 5.5 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Hard-coded credentials - [TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes](https://agentprime.io/advisories/GHSA-438c-3975-5x3f.md) `GHSA-438c-3975-5x3f`, `CVE-2024-29203`, `PKSA-s5r2-shvb-ydth` · npm `tinymce` and 2 more: affected `<6.8.1`, fixed in `6.8.1` · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2024 · Tags: Cross-site scripting (XSS) - [TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements](https://agentprime.io/advisories/GHSA-5359-pvf2-pw78.md) `GHSA-5359-pvf2-pw78`, `CVE-2024-29881`, `PKSA-hdg2-6rxt-d4qn` · npm `tinymce` and 2 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2024 · Tags: Cross-site scripting (XSS) - [WiX based installers are vulnerable to binary hijack when run as SYSTEM](https://agentprime.io/advisories/GHSA-rf39-3f98-xr7r.md) `GHSA-rf39-3f98-xr7r`, `CVE-2024-29187` · NuGet `wix` and 1 more: affected `<3.14.1 || >=4.0.0, <4.0.5`, fixed in `3.14.1`, `4.0.5` · CVSS 7.3 High · Not analysed yet · Published 25 Mar 2024 · Tags: Broken access control - [Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files](https://agentprime.io/advisories/GHSA-jx4p-m4wm-vvjg.md) `GHSA-jx4p-m4wm-vvjg`, `CVE-2024-29188` · NuGet `wix` and 1 more: affected `<3.14.1 || >=4.0.0, <4.0.5`, fixed in `3.14.1`, `4.0.5` · CVSS 7.8 High · Not analysed yet · Published 25 Mar 2024 · Tags: Path traversal - [WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM](https://agentprime.io/advisories/GHSA-g4v6-69p6-q3p4.md) `GHSA-g4v6-69p6-q3p4` · NuGet `PanelSwWix4.Sdk`: affected `<5.0.0-psw-wix.0265-49`, fixed in `5.0.0-psw-wix.0265-49` · CVSS 7.3 High · Not analysed yet · Published 25 Mar 2024 - [WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM](https://agentprime.io/advisories/GHSA-wq88-fq4x-h2pm.md) `GHSA-wq88-fq4x-h2pm` · NuGet `PanelSW.Custom.WiX`: affected `<3.15.0-a46`, fixed in `3.15.0-a46` · CVSS 7.3 High · Not analysed yet · Published 25 Mar 2024 - [Umbraco possible user enumeration](https://agentprime.io/advisories/GHSA-552f-97wf-pmpq.md) `GHSA-552f-97wf-pmpq`, `CVE-2024-28868` · NuGet `UmbracoCMS`: affected `>=10.0.0, <10.8.5`, fixed in `10.8.5` · CVSS 3.7 Low · Not analysed yet · Published 20 Mar 2024 · Tags: Information disclosure, CWE-204 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .