Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
4,189
Erlang
31
GitHub Actions
19
Go
1,985
Maven
5,000+
npm
3,701
NuGet
657
pip
3,326
Pub
11
RubyGems
882
Rust
836
Swift
35
Unreviewed advisories
All unreviewed
5,000+

95 advisories

Loading
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames High
CVE-2017-1000452 was published for samlify (npm) Jan 4, 2018
eoftedal
Ruby-saml allows attackers to perform XML signature wrapping attacks High
CVE-2016-5697 was published for ruby-saml (RubyGems) Aug 21, 2018
Dom4j contains a XML Injection vulnerability High
CVE-2018-1000632 was published for dom4j:dom4j (Maven) Oct 16, 2018
Apache Struts REST Plugin can potentially allow a DoS attack High
CVE-2018-1327 was published for org.apache.struts:struts2-rest-plugin (Maven) Oct 16, 2018
sunSUNQ
XML Injection in python-libnmap High
CVE-2019-1010017 was published for python-libnmap (pip) Jul 18, 2019
XXE in PHPSpreadsheet due to encoding issue High
CVE-2018-19277 was published for phpoffice/phpspreadsheet (Composer) Nov 20, 2019
MarkLee131
Duplicate Advisory: XML Injection in petl Critical
GHSA-69q2-p9xp-739v was published for petl (pip) Apr 20, 2021 • withdrawn
Layout XML Arbitrary Code Fix High
CVE-2021-32758 was published for openmage/magento-lts (Composer) Aug 30, 2021
XML External Entity Injection in PyWPS High
CVE-2021-39371 was published for pywps (pip) Sep 2, 2021
tdunlap607
Infinite Loop in Apache Xerces Java Moderate
CVE-2022-23437 was published for xerces:xercesImpl (Maven) Jan 27, 2022
XML Injection in Crafter CMS Crafter Studio 3.0.1 High
CVE-2017-15685 was published for org.craftercms:crafter-studio (Maven) Feb 9, 2022
An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test... High Unreviewed
CVE-2022-22834 was published Mar 11, 2022
ALIN MDaemon Security Gateway through 8.5.0 allows XML Injection. Moderate Unreviewed
CVE-2022-25356 was published Apr 6, 2022
XML Injection in Xerces Java affects Nokogiri Moderate
GHSA-xxx9-3xcr-gjj3 was published for nokogiri (RubyGems) Apr 11, 2022
A vulnerability in CLI of Cisco Firepower Threat Defense (FTD) Software could allow an... High Unreviewed
CVE-2022-20729 was published May 4, 2022
D-Link DIR-865L has PHP File Inclusion in the router xml file. High Unreviewed
CVE-2013-4857 was published May 5, 2022
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate... High Unreviewed
CVE-2017-10603 was published May 13, 2022
SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30,... High Unreviewed
CVE-2019-0268 was published May 14, 2022
Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not... High Unreviewed
CVE-2018-2477 was published May 14, 2022
XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized... High Unreviewed
CVE-2018-16785 was published May 14, 2022
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type=... High Unreviewed
CVE-2018-16784 was published May 14, 2022
Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18,... High Unreviewed
CVE-2008-5024 was published May 14, 2022
Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in... High Unreviewed
CVE-2018-1000526 was published May 14, 2022
XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an... High Unreviewed
CVE-2016-6272 was published May 14, 2022
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection... Critical Unreviewed
CVE-2013-7429 was published May 17, 2022
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database