# NuGet Advisories. Every NuGet Advisory we hold (.NET), newest first. ## Records, newest first (an older page) - [Umbraco Makes User Enumeration Feasible Based on Timing of Login Response](https://agentprime.io/advisories/GHSA-4g8m-5mj5-c8xg.md) `GHSA-4g8m-5mj5-c8xg`, `CVE-2025-46736` · NuGet `Umbraco.Cms`: affected `<10.8.10 || >=11.0.0-rc1, <13.8.1`, fixed in `10.8.10`, `13.8.1` · CVSS 5.3 Medium · Not analysed yet · Published 6 May 2025 · Tags: CWE-204 - [Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file](https://agentprime.io/advisories/GHSA-c82r-c9f7-f5mj.md) `GHSA-c82r-c9f7-f5mj`, `CVE-2025-46326` · NuGet `Snowflake.Data`: affected `>=2.1.2, <4.4.1`, fixed in `4.4.1` · CVSS 3.3 Low · Not analysed yet · Published 28 Apr 2025 · Tags: Race condition - [YoutubeDLSharp allows command injection on windows system due to non sanitized arguments](https://agentprime.io/advisories/GHSA-2jh5-g5ch-43q5.md) `GHSA-2jh5-g5ch-43q5`, `CVE-2025-43858` · NuGet `YoutubeDLSharp`: affected `>=1.0.0-beta4, <1.1.2`, fixed in `1.1.2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2025 · Tags: Command injection - [Infinite loop condition in Amazon.IonDotnet](https://agentprime.io/advisories/GHSA-gm2p-wf5c-w3pj.md) `GHSA-gm2p-wf5c-w3pj`, `CVE-2025-3857` · NuGet `Amazon.IonDotnet`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 8.7 High · Not analysed yet · Published 21 Apr 2025 · Tags: Insecure deserialization, Denial of service - [Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-9g64-r942-fvmp.md) `GHSA-9g64-r942-fvmp`, `CVE-2025-29953` · NuGet `Apache.NMS.ActiveMQ`: affected `<2.1.1`, fixed in `2.1.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Apr 2025 · Tags: Insecure deserialization - [CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows](https://agentprime.io/advisories/GHSA-f87w-3j5w-v58p.md) `GHSA-f87w-3j5w-v58p` · NuGet `CefSharp.OffScreen` and 6 more: affected `<134.3.90`, fixed in `134.3.90` · CVSS 8.3 High · Not analysed yet · Published 12 Apr 2025 - [Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs](https://agentprime.io/advisories/GHSA-rpq8-q44m-2rpg.md) `GHSA-rpq8-q44m-2rpg`, `CVE-2025-32016` · NuGet `Microsoft.Identity.Abstractions` and 1 more: affected `>=7.1.0, <9.0.0`, fixed in `9.0.0` · CVSS 4.7 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Information disclosure - [DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/GHSA-3f7v-qx94-666m.md) `GHSA-3f7v-qx94-666m`, `CVE-2025-32372` · NuGet `DotNetNuke.Core`: affected `<9.13.8`, fixed in `9.13.8` · CVSS 6.5 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: Server-side request forgery (SSRF) - [Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users](https://agentprime.io/advisories/GHSA-q62r-8ppj-xvf4.md) `GHSA-q62r-8ppj-xvf4`, `CVE-2025-32017` · NuGet `Umbraco.Cms`: affected `>=14.0.0--preview004, <14.3.4 || >=15.0.0-rc1, <15.3.1`, fixed in `14.3.4`, `15.3.1` · CVSS 8.8 High · Not analysed yet · Published 9 Apr 2025 · Tags: Path traversal - [Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-2865-hh9g-w894.md) `GHSA-2865-hh9g-w894`, `BIT-aspnet-core-2025-24070`, `CVE-2025-24070` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 12 more: affected `>=6.0.0, <=6.0.36 || >=8.0.0, <8.0.14 || >=9.0.0, <9.0.3`, fixed in `8.0.14`, `9.0.3` · CVSS 7.0 High · Not analysed yet · Published 11 Mar 2025 · Tags: Authentication bypass - [Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content](https://agentprime.io/advisories/GHSA-wx5h-wqfq-v698.md) `GHSA-wx5h-wqfq-v698`, `CVE-2025-27602` · NuGet `Umbraco.Cms.Web.Backoffice`: affected `<10.8.9 || >=11.0.0-rc1, <13.7.1`, fixed in `10.8.9`, `13.7.1` · CVSS 4.9 Medium · Not analysed yet · Published 11 Mar 2025 · Tags: Broken access control - [Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality](https://agentprime.io/advisories/GHSA-6ffg-mjg7-585x.md) `GHSA-6ffg-mjg7-585x`, `CVE-2025-27601` · NuGet `Umbraco.Cms.Api.Management`: affected `<14.3.3 || >=15.0.0-rc1, <15.2.3`, fixed in `14.3.3`, `15.2.3` · CVSS 4.3 Medium · Not analysed yet · Published 11 Mar 2025 · Tags: Broken access control - [Microsoft Security Advisory CVE-2025-24043 | WinDbg Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-hpw7-8qpc-34p3.md) `GHSA-hpw7-8qpc-34p3`, `CVE-2025-24043` · NuGet `dotnet-debugger-extensions` and 2 more: affected `<9.0.607601`, fixed in `9.0.607601` · CVSS 7.5 High · Not analysed yet · Published 7 Mar 2025 · Tags: Weak cryptography or TLS - [DoS Vulnerability in TraceContextPropagator.Extract - OpenTelemetry.Api](https://agentprime.io/advisories/GHSA-vc29-vg52-6643.md) `GHSA-vc29-vg52-6643` · NuGet `OpenTelemetry.AutoInstrumentation`: affected `>=1.10.0-beta.1, <1.11.0`, fixed in `1.11.0` · CVSS 7.5 High · Not analysed yet · Published 6 Mar 2025 · Tags: Denial of service - [Out-of-bounds Write in SixLabors ImageSharp](https://agentprime.io/advisories/GHSA-2cmq-823j-5qj8.md) `GHSA-2cmq-823j-5qj8`, `CVE-2025-27598` · NuGet `SixLabors.ImageSharp`: affected `<2.1.10 || >=3.0.0, <3.1.7`, fixed in `2.1.10`, `3.1.7` · CVSS 7.5 High · Not analysed yet · Published 6 Mar 2025 · Tags: Memory corruption - [OpenTelemetry .NET has Denial of Service (DoS) Vulnerability in API Package](https://agentprime.io/advisories/GHSA-8785-wc3w-h8q6.md) `GHSA-8785-wc3w-h8q6`, `CVE-2025-27513` · NuGet `OpenTelemetry.Api`: affected `>=1.11.0, <1.11.2`, fixed in `1.11.2` · CVSS 7.5 High · Not analysed yet · Published 5 Mar 2025 · Tags: Denial of service - [Security Update for the OPC UA .NET Standard Stack](https://agentprime.io/advisories/GHSA-h958-fxgg-g7w3.md) `GHSA-h958-fxgg-g7w3`, `CVE-2024-42512` · NuGet `OPCFoundation.NetStandard.Opc.Ua.Core`: affected `<1.5.374.158`, fixed in `1.5.374.158` · CVSS 5.9 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Broken access control, CWE-208 - [Security Update for the OPC UA .NET Standard Stack](https://agentprime.io/advisories/GHSA-4rcc-7pg7-f57f.md) `GHSA-4rcc-7pg7-f57f`, `CVE-2024-42513` · NuGet `OPCFoundation.NetStandard.Opc.Ua.Bindings.Https`: affected `<1.5.374.158`, fixed in `1.5.374.158` · CVSS 6.5 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: Authentication bypass, CWE-305 - [AutoQueryable leaks sensitive information](https://agentprime.io/advisories/GHSA-m4mm-534h-5cp5.md) `GHSA-m4mm-534h-5cp5`, `CVE-2024-57716` · NuGet `AutoQueryable`: affected `<=2.0.11-beta`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2025 · Tags: Information disclosure - [Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens](https://agentprime.io/advisories/GHSA-qxj7-2x7w-3mpp.md) `GHSA-qxj7-2x7w-3mpp`, `CVE-2025-26620` · NuGet `Duende.AccessTokenManagement`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 6.3 Medium · Not analysed yet · Published 19 Feb 2025 · Tags: Race condition - [AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass](https://agentprime.io/advisories/GHSA-vq63-8f72-f486.md) `GHSA-vq63-8f72-f486`, `CVE-2025-24895` · NuGet `CIE.AspNetCore.Authentication`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2025 · Tags: Authentication bypass - [The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass](https://agentprime.io/advisories/GHSA-36h8-r92j-w9vw.md) `GHSA-36h8-r92j-w9vw`, `CVE-2025-24894` · NuGet `SPID.AspNetCore.Authentication`: affected `<3.4.0`, fixed in `3.4.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2025 · Tags: Authentication bypass - [Duplicate Advisory: Authorization Bypass in OPC UA .NET Standard Stack](https://agentprime.io/advisories/GHSA-qv5f-57gw-vx3h.md) `GHSA-qv5f-57gw-vx3h` · NuGet `OPCFoundation.NetStandard.Opc.Ua`: affected `<1.5.374.158`, fixed in `1.5.374.158` · CVSS 8.6 High · Withdrawn · Not analysed yet · Published 10 Feb 2025 · Tags: Broken access control, CWE-208 - [Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack](https://agentprime.io/advisories/GHSA-7wwr-h8cm-9jf7.md) `GHSA-7wwr-h8cm-9jf7` · NuGet `OPCFoundation.NetStandard.Opc.Ua`: affected `<1.5.374.158`, fixed in `1.5.374.158` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 10 Feb 2025 · Tags: Authentication bypass, CWE-305 - [TShock allows chat while not fully connected, possible ban evasion](https://agentprime.io/advisories/GHSA-f8mx-cwfh-7hr2.md) `GHSA-f8mx-cwfh-7hr2` · NuGet `TShock`: affected `<5.2.2`, fixed in `5.2.2` · CVSS 4.0, no score published · Not analysed yet · Published 3 Feb 2025 · Tags: Broken access control - [Snowflake.Data has weak temporary files permissions](https://agentprime.io/advisories/GHSA-2mqw-rq5m-8hc8.md) `GHSA-2mqw-rq5m-8hc8`, `CVE-2025-24788` · NuGet `Snowflake.Data`: affected `>=2.0.12, <4.3.0`, fixed in `4.3.0` · CVSS 5.0 Medium · Not analysed yet · Published 29 Jan 2025 · Tags: Broken access control - [Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting](https://agentprime.io/advisories/GHSA-572q-86rr-5vgq.md) `GHSA-572q-86rr-5vgq`, `CVE-2024-55488` · NuGet `Umbraco.Cms.Infrastructure`: affected `<15.0.0`, fixed in `15.0.0` · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 22 Jan 2025 · Tags: Cross-site scripting (XSS) - [Property reflection in System.Linq.Dynamic.Core](https://agentprime.io/advisories/GHSA-4cv2-4hjh-77rx.md) `GHSA-4cv2-4hjh-77rx`, `CVE-2024-51417` · NuGet `System.Linq.Dynamic.Core`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 6.4 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: Broken access control - [XSS/HTML Injection Vulnerability in Umbraco Preview Badge](https://agentprime.io/advisories/GHSA-69cg-w8vm-h229.md) `GHSA-69cg-w8vm-h229`, `CVE-2024-10761` · NuGet `Umbraco.Cms` and 1 more: affected `>=10.8.7, <10.8.8 || >=11.0.0, <13.5.3 || >=14.0.0, <14.3.2 || >=15.0.0, <15.1.2`, fixed in `10.8.8`, `13.5.3`, `14.3.2`, `15.1.2` · CVSS 6.9 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: Cross-site scripting (XSS), Code injection - [Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes](https://agentprime.io/advisories/GHSA-hmg4-wwm5-p999.md) `GHSA-hmg4-wwm5-p999`, `CVE-2025-24011` · NuGet `Umbraco.Cms`: affected `>=14.0.0, <14.3.2 || >=15.0.0, <15.1.2`, fixed in `14.3.2`, `15.1.2` · CVSS 5.3 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: Information disclosure - [XSS/HTML Injection Vulnerability in Umbraco Backoffice Components](https://agentprime.io/advisories/GHSA-wv8v-rmw2-25wc.md) `GHSA-wv8v-rmw2-25wc`, `CVE-2025-24012` · npm `@umbraco-cms/backoffice` and 1 more: affected `>=14.0.0, <14.3.2 || >=15.0.0, <15.1.2`, fixed in `14.3.2`, `15.1.2` · CVSS 4.6 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: Cross-site scripting (XSS) - [Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-gjf6-3w4p-7xfh.md) `GHSA-gjf6-3w4p-7xfh`, `BIT-dotnet-2025-21176`, `BIT-dotnet-sdk-2025-21176`, `CVE-2025-21176` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.12 || >=9.0.0, <9.0.1`, fixed in `8.0.12`, `9.0.1` · CVSS 8.8 High · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-126 - [Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-jjcv-wr2g-4rv4.md) `GHSA-jjcv-wr2g-4rv4`, `BIT-dotnet-2025-21172`, `BIT-dotnet-sdk-2025-21172`, `CVE-2025-21172` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.12 || >=9.0.0, <9.0.1`, fixed in `8.0.12`, `9.0.1` · CVSS 7.5 High · Not analysed yet · Published 14 Jan 2025 · Tags: Memory corruption - [Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-p54p-p3qm-8vgj.md) `GHSA-p54p-p3qm-8vgj`, `BIT-dotnet-2025-21171`, `BIT-dotnet-sdk-2025-21171`, `BIT-powershell-2025-21171`, `CVE-2025-21171` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=9.0.0, <9.0.1`, fixed in `9.0.1` · CVSS 7.5 High · Not analysed yet · Published 14 Jan 2025 · Tags: Memory corruption - [Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length](https://agentprime.io/advisories/GHSA-9v8m-qv22-f268.md) `GHSA-9v8m-qv22-f268`, `CVE-2025-23041` · NuGet `Umbraco.Forms` and 1 more: affected `<10.5.7 || >=11.0.0-rc1, <13.2.2 || >=14.0.0-beta001, <14.1.2`, fixed in `10.5.7`, `13.2.2`, `14.1.2` · CVSS 5.8 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-20, CWE-602 - [Git Credential Manager carriage-return character in remote URL allows malicious repository to leak credentials](https://agentprime.io/advisories/GHSA-86c2-4x57-wc8g.md) `GHSA-86c2-4x57-wc8g`, `CVE-2024-50338` · NuGet `git-credential-manager`: affected `<2.6.1`, fixed in `2.6.1` · CVSS 7.4 High · Not analysed yet · Published 14 Jan 2025 · Tags: Information disclosure, CWE-436 - [The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package](https://agentprime.io/advisories/GHSA-mgr7-5782-6jh9.md) `GHSA-mgr7-5782-6jh9` · NuGet `Umbraco.Headless.Client.Net`: affected `<1.5.0`, fixed in `1.5.0` · No CVSS score · Not analysed yet · Published 13 Jan 2025 · Tags: Other injection, CWE-1395 - [Piranha CMS Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-mmx8-vrfg-hfmq.md) `GHSA-mmx8-vrfg-hfmq`, `CVE-2024-55341` · NuGet `Piranha`: affected `<=11.1.0`, no fixed version yet · CVSS 4.7 Medium · Not analysed yet · Published 20 Dec 2024 · Tags: Cross-site scripting (XSS) - [Piranha CMS Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-cmwp-442x-3rcv.md) `GHSA-cmwp-442x-3rcv`, `CVE-2024-55342` · NuGet `Piranha`: affected `<=11.1.0`, no fixed version yet · CVSS 4.7 Medium · Not analysed yet · Published 20 Dec 2024 · Tags: Cross-site scripting (XSS) - [Oqtane Framework Insecure Direct Object Reference vulnerability](https://agentprime.io/advisories/GHSA-hhcw-wwxv-g95c.md) `GHSA-hhcw-wwxv-g95c`, `CVE-2024-55471` · NuGet `Oqtane.Framework` and 1 more: affected `<=6.0.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 20 Dec 2024 · Tags: Broken access control - [Oqtane Framework Incorrect Access Control vulnerability](https://agentprime.io/advisories/GHSA-995c-qww8-64fj.md) `GHSA-995c-qww8-64fj`, `CVE-2024-55470` · NuGet `Oqtane.Framework` and 1 more: affected `<=6.0.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Dec 2024 · Tags: Authentication bypass - [Oqtane Framework Insecure Direct Object Reference vulnerability](https://agentprime.io/advisories/GHSA-2hr5-cvwp-jr5w.md) `GHSA-2hr5-cvwp-jr5w`, `CVE-2024-55186` · NuGet `Oqtane.Client` and 3 more: affected `<=6.0.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 20 Dec 2024 · Tags: Broken access control - [TShock Security Escalation Exploit](https://agentprime.io/advisories/GHSA-hvm9-wc8j-mgrc.md) `GHSA-hvm9-wc8j-mgrc` · NuGet `TShock`: affected `>=4.3.21, <5.2.1`, fixed in `5.2.1` · CVSS 4.0, no score published · Not analysed yet · Published 18 Dec 2024 · Tags: Authentication bypass, Broken access control, CWE-305 - [Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications](https://agentprime.io/advisories/GHSA-j6vm-4r7g-x4gr.md) `GHSA-j6vm-4r7g-x4gr`, `CVE-2024-11862` · NuGet `Devolutions.XTS.NET`: affected `<2024.11.26`, fixed in `2024.11.26` · CVSS 5.1 Medium · Not analysed yet · Published 27 Nov 2024 · Tags: CWE-385 - [DotNetZip Directory Traversal vulnerability](https://agentprime.io/advisories/GHSA-xhg6-9j5j-w4vf.md) `GHSA-xhg6-9j5j-w4vf`, `CVE-2024-48510` · NuGet `DotNetZip` and 1 more: affected `>=1.10.1, <=1.16.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Nov 2024 · Tags: Path traversal - [.NET Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-v7vf-f5q6-m899.md) `GHSA-v7vf-f5q6-m899`, `BIT-dotnet-2024-43498`, `BIT-dotnet-sdk-2024-43498`, `CVE-2024-43498` · NuGet `System.Formats.Nrbf`: affected `<9.0.0`, fixed in `9.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Nov 2024 · Tags: Memory corruption - [.NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-6x36-qxmj-rv4p.md) `GHSA-6x36-qxmj-rv4p`, `BIT-dotnet-2024-43499`, `BIT-dotnet-sdk-2024-43499`, `CVE-2024-43499` · NuGet `System.Formats.Nrbf`: affected `<9.0.0`, fixed in `9.0.0` · CVSS 7.5 High · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-409, CWE-606 - [Duplicate Advisory: .NET and Visual Studio Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-wmm6-pgp8-29hg.md) `GHSA-wmm6-pgp8-29hg` · NuGet `System.Formats.Nrbf`: affected `<9.0.0`, fixed in `9.0.0` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-409, CWE-606 - [Duplicate Advisory: .NET and Visual Studio Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-8rxm-6783-qh55.md) `GHSA-8rxm-6783-qh55` · NuGet `System.Formats.Nrbf`: affected `<9.0.0`, fixed in `9.0.0` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 12 Nov 2024 · Tags: Memory corruption - [HTTP Client uses incorrect token after refresh](https://agentprime.io/advisories/GHSA-7mr7-4f54-vcx5.md) `GHSA-7mr7-4f54-vcx5`, `CVE-2024-51987` · NuGet `Duende.AccessTokenManagement.OpenIdConnect`: affected `>=3.0.0, <3.0.1`, fixed in `3.0.1` · CVSS 5.4 Medium · Not analysed yet · Published 7 Nov 2024 · Tags: Privilege escalation - [CRLF injection in Refit's \[Header\], \[HeaderCollection\] and \[Authorize\] attributes](https://agentprime.io/advisories/GHSA-3hxg-fxwm-8gf7.md) `GHSA-3hxg-fxwm-8gf7`, `CVE-2024-51501` · NuGet `Refit`: affected `<7.2.22`, fixed in `7.2.22` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2024 · Tags: Other injection - [Duplicate Advisory: Umbraco CMS Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-4gmq-m9vp-jrwg.md) `GHSA-4gmq-m9vp-jrwg` · NuGet `Umbraco.Cms.Core`: affected `<=12.3.6`, no fixed version yet · CVSS 3.5 Low · Withdrawn · Not analysed yet · Published 4 Nov 2024 · Tags: Cross-site scripting (XSS), CWE-707 - [Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-2qw8-ppr5-m96c.md) `GHSA-2qw8-ppr5-m96c`, `CVE-2024-43383` · NuGet `Lucene.Net.Replicator`: affected `>=4.8.0-beta00005, <4.8.0-beta00017`, fixed in `4.8.0-beta00017` · CVSS 8.0 High · Not analysed yet · Published 31 Oct 2024 · Tags: Insecure deserialization - [ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected](https://agentprime.io/advisories/GHSA-24mc-gc52-47jv.md) `GHSA-24mc-gc52-47jv`, `CVE-2024-50353` · NuGet `ICG.AspNetCore.Utilities.CloudStorage`: affected `<8.0.0`, fixed in `8.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2024 · Tags: Broken access control - [Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs](https://agentprime.io/advisories/GHSA-v9xq-2mvm-x8xc.md) `GHSA-v9xq-2mvm-x8xc`, `CVE-2024-49755` · NuGet `Duende.IdentityServer`: affected `>=7.0.0, <7.0.8`, fixed in `7.0.8` · CVSS 3.1 Low · Not analysed yet · Published 28 Oct 2024 · Tags: Authentication bypass - [MPXJ has a Potential Path Traversal Vulnerability](https://agentprime.io/advisories/GHSA-j945-c44v-97g6.md) `GHSA-j945-c44v-97g6`, `CVE-2024-49771`, `PYSEC-2026-1681` · Maven `net.sf.mpxj:mpxj` and 6 more: affected `>=8.3.5, <13.5.1`, fixed in `13.5.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2024 · Tags: Path traversal - [Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out](https://agentprime.io/advisories/GHSA-wxw9-6pv9-c3xc.md) `GHSA-wxw9-6pv9-c3xc`, `CVE-2024-48929` · NuGet `Umbraco.CMS`: affected `>=10.0.0, <10.8.7 || >=13.0.0, <13.5.2`, fixed in `10.8.7`, `13.5.2` · CVSS 4.2 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: Authentication bypass - [Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice](https://agentprime.io/advisories/GHSA-5955-cwv4-h7qh.md) `GHSA-5955-cwv4-h7qh`, `CVE-2024-48927` · NuGet `Umbraco.Cms` and 1 more: affected `>=10.0.0, <10.8.7 || >=13.0.0, <13.5.2`, fixed in `10.8.7`, `13.5.2` · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: Other injection - [Umbraco CMS logout page displayed before session expiration](https://agentprime.io/advisories/GHSA-fp6q-gccw-7qqm.md) `GHSA-fp6q-gccw-7qqm`, `CVE-2024-48926` · NuGet `Umbraco.CMS` and 1 more: affected `>=10.0.0, <10.8.7 || >=13.0.0, <13.5.2`, fixed in `10.8.7`, `13.5.2` · CVSS 4.2 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: Authentication bypass - [Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API](https://agentprime.io/advisories/GHSA-4gp9-ff99-j6vj.md) `GHSA-4gp9-ff99-j6vj`, `CVE-2024-48925` · NuGet `Umbraco.CMS`: affected `>=14.0.0, <14.3.0`, fixed in `14.3.0` · CVSS 0.0 None · Not analysed yet · Published 22 Oct 2024 · Tags: Broken access control Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .