5056 matches found
HTTP Response Splitting in Styx
Vulnerability Styx is vulnerable to CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting'. Vulnerable Component The vulnerable component is the com.hotels.styx.api.HttpHeaders.Builder due to disabling the HTTP Header validation built into Netty in these...
Fedora 31 : golang-github-gorilla-websocket (2020-0ae6297680)
Update to latest version. Fix GHSA-jf24-p9p9-4rjh. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....
Fedora 30 : golang-github-gorilla-websocket (2020-8f18c45545)
Update to latest version. Fix GHSA-jf24-p9p9-4rjh. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....
GHSA-MXHP-79QH-MCX6 vulnerabilities
Vulnerabilities for packages: kubeflow-centraldashboard...
GHSA-R6J9-8759-G62W vulnerabilities
Vulnerabilities for packages: hadoop-fips...
GHSA-H822-R4R5-V8JG vulnerabilities
Vulnerabilities for packages: mysql...
Prototype Pollution
Overview Affected versions of mithrilare vulnerable to prototype pollution. The function parseQueryString may allow a malicious user to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. A payload such as...
@gkatsev/grunt-harp (>=0.18.0, <=0.19.0), @mobify/documentation-theme (>=1.11.3, <=2.0.0-preview.2-dev) +21 more potentially affected by CVE-2019-5437 via harp (>=0.9.5, <=0.32.0)
harp NPM version =0.9.5, =0.18.0, =1.11.3, =1.11.3, =0.0.3, =0.0.8-pre2, =0.0.1, =0.0.1, =0.0.1-1, =0.0.1, =0.1.0, =0.1.0, =0.2.9 - n-p-m 1.1.0 and more Source cves: CVE-2019-5437 Source advisory: OSV:GHSA-46HV-7769-J7RX...
@any4/model (>=0.0.1, <=1.2.4), @boundstate/hapi-typeorm (0.0.1) +35 more potentially affected by unknown CVE via typeorm (>=0.0.2-alpha.43, <=0.1.14)
typeorm NPM version =0.0.2-alpha.43, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.6.2, =0.1.2, =0.1.19, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W7Q7-VJP8-7JV4...
@aliens-lyon.fr/ep_mypads (1.7.24), @buzuli/all (>=1.0.0, <=1.1.0) +811 more potentially affected by unknown CVE via mysql (>=2.0.0, <=2.13.0)
mysql NPM version =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.2, =4.49.0, =1.0.0, =3.2.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5F7M-MMPC-QHH4...
GHSA-VX85-MJ8C-4QM6 vulnerabilities
Vulnerabilities for packages: trino, druid...
GHSA-9MXF-G3X6-WV74 vulnerabilities
Vulnerabilities for packages: hive...
@1337lawyers/design (>=0.1.0, <=0.1.38), @9188/w-cli (>=1.0.0, <=1.0.4) +50 more potentially affected by CVE-2018-6342 via react-dev-utils (>=5.0.0, <=5.0.1)
react-dev-utils NPM version =5.0.0, =0.1.0, =1.0.0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.5, =1.0.0-beta.28, =1.0.1, =1.0.0, =1.0.0, =0.26.4, =0.0.0-legacy, =3.10.0-beta.0, =0.1.0-alpha.0, =2.1.16, =2.3.5 - aqxy-common-ui 0.0.1 and more Source cves: CVE-2018-6342 Source advisory:...
Moderate severity vulnerability that affects org.keycloak:keycloak-core
Withdrawn: Duplicate of CVE-2017-12161 / GHSA-959q-32g8-vvp7...
Arbitrary JavaScript Execution
Overview A vulnerability exists in bassmaster = 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval. Recommendation Update to bassmaster version 1.5.2 or greater. References - Commit b751602 - GitHub Advisory...
