GHSA-7p9f-6x8j-gxxp: CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

GHSA-hh33-46q4-hwm2: Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

GHSA-rmv2-8jjc-23xw: TCPDF Local File Inclusion vulnerability

GHSA-w5rq-g9r6-vrcg: @dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling

GHSA-q4xm-6fjc-5f6w: sigstore-java has vulnerability with bundle verification

Moq v4.20.0 and 4.20.1 include support for [SponsorLink](https://github.com/devlooped/SponsorLink), which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.

Moq v4.20.2 has removed this functionality.

**Moq v4.20.0 and 4.20.1 share hashed user data**

Low severity GitHub Reviewed Published Aug 10, 2023 to the GitHub Advisory Database • Updated Aug 10, 2023

Headline

GHSA-6r78-m64m-qwcf: Moq v4.20.0 and 4.20.1 share hashed user data

ghsa: Latest News