GHSA-fhcw-px4q-pmvv: Liferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key

GHSA-3cm9-jrf5-h2cx: Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key 

GHSA-6fgx-x7m2-74qm: tracexec has `env` command argument injection via environment variables starting with dash in traced exec events

GHSA-77r9-w39m-9xh5: Omni vulnerable to information leak via API

GHSA-4p3p-cr38-v5xp: Omni is Vulnerable to DoS via Empty Create/Update Resource Requests

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.

**mongo-express Cross-site Request Forgery vulnerability**

Moderate severity GitHub Reviewed Published Mar 1, 2024 to the GitHub Advisory Database • Updated Mar 1, 2024

Headline

GHSA-fffg-cwc9-xvj7: mongo-express Cross-site Request Forgery vulnerability

ghsa: Latest News