GHSA-6729-95v3-pjc2: HL7 FHIR IG Publisher potentially exposes GitHub repo user and credential information

GHSA-3wwr-3g9f-9gc7: ASTEVAL Allows Maliciously Crafted Format Strings Lead to Sandbox Escape

GHSA-v34r-vj4r-38j6: Updatecli exposes Maven credentials in console output

GHSA-vqf5-2xx6-9wfm: GitHub PAT written to debug artifacts

GHSA-8c3x-hq82-gjcm: XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources.
Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.

**Apache Wicket: An attacker can intentionally trigger a memory leak**

Critical severity GitHub Reviewed Published Jan 23, 2025 to the GitHub Advisory Database • Updated Jan 23, 2025

Headline

GHSA-9cxr-76pm-j3wf: Apache Wicket: An attacker can intentionally trigger a memory leak

ghsa: Latest News