GHSA-w7qr-q9fh-fj35: Dozzle uses unsafe hash for passwords

GHSA-mq92-jr35-ffpc: open-webui allows enumeration of file names and traversal of directories by observing the error messages

GHSA-xcvc-5hgv-phqg: open-webui Insecure Direct Object Reference (IDOR) vulnerability

GHSA-54f4-v6v9-9q82: open-webui allows writing and deleting arbitrary files

GHSA-7qmx-3fpx-r45m: Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

**Prometheus XSS Vulnerability**

Moderate severity GitHub Reviewed Published Dec 13, 2023 to the GitHub Advisory Database • Updated Dec 13, 2023

Headline

GHSA-3m87-5598-2v4f: Prometheus XSS Vulnerability

ghsa: Latest News