25 matches found
CVE-2023-32696 Excessive permissions for ckan user
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the ckan user equivalent to www-data owned code and configuration files in the docker container and the ckan user had the permissions to use sudo. These issues allowed for co...
CVE-2021-32696
The npm package "striptags" is an implementation of PHP's striptags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be abused by an attack...
CVE-2021-32696
The CVE-2021-32696 issue affects the npm package striptags (TypeScript implementation of PHP’s strip_tags). Before version 3.2.0 , passing an array-like object as the HTML argument can trigger a type-confusion that concatenates unsanitized strings, enabling a XSS when input shape is attacker-cont...
@adv-ui/nc-strings (3.2.0), @arshad/gatsby-theme-phoenix (>=1.1.0, <=1.1.8) +154 more potentially affected by CVE-2021-32696 via striptags (>=3.0.0, <=3.1.1)
striptags NPM version =3.0.0, =1.1.0, =1.0.0, =0.1.0, =0.3.0, =1.1.1-alpha.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.3.3, =1.0.2, =1.0.6 and more Source cves: CVE-2021-32696 Source advisory: OSV:GHSA-QXG5-2QFF-P49R...