ae.teletronics.nlp:entityextraction (1.3), ae.teletronics.nlp:w2vec (1.0) +1628 more potentially affected by CVE-2021-21409 via io.netty:netty (3.8.0.final)

io.netty:netty MAVEN version 3.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - ae.teletronics.nlp:entityextraction 1.3 - ae.teletronics.nlp:w2vec 1.0 - ai.grakn:client-java 1.3.0 - ai.grakn:grakn-bootup...

au.com.intelix:rs-auth_2.11 (0.1.3.1), au.com.intelix:rs-core-codec-binary_2.11 (0.1.3.1) +378 more potentially affected by CVE-2021-21409 via io.netty:netty (3.10.3.final)

io.netty:netty MAVEN version 3.10.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - au.com.intelix:rs-auth2.11 0.1.3.1 - au.com.intelix:rs-core-codec-binary2.11 0.1.3.1 - au.com.intelix:rs-core-evt2.11 0.1.3....

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.clarity.codeartifact:ai.clarity.codeartifact.gradle.plugin (>=0.0.1, <=0.0.10) +10824 more potentially affected by CVE-2021-21409 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.60.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =1.4.6, =0.0.1, =0.0.1, =0.5.0, =0.0.1, =0.0.14, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

CVE-2021-21409

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final there is a vulnerability that enables request smuggling. The...

GHSA-G2FG-MR77-6VRM vulnerabilities

Vulnerabilities for packages: druid, trino...

ai.grakn:grakn-test-tools (0.15.0), ai.h2o:h2o-app (>=3.22.0.1, <=3.28.0.1) +2756 more potentially affected by CVE-2021-21295 +1 more via io.netty:netty (3.7.0.final)

io.netty:netty MAVEN version 3.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - ai.grakn:grakn-test-tools 0.15.0 - ai.h2o:h2o-app =3.22.0.1, =3.22.0.1, =3.22.0.1, =2.0.26, =2.0.26, =1.11.0, =1.0.0, =1.0.0,...

au.com.dius:pact-jvm-consumer_2.10 (>=1.5, <=1.10), au.com.dius:pact-jvm-model_2.10 (>=1.5, <=1.10) +217 more potentially affected by CVE-2021-21295 +1 more via io.netty:netty (3.5.5.final)

io.netty:netty MAVEN version 3.5.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - au.com.dius:pact-jvm-consumer2.10 =1.5, =1.5, =1.5, =1.5, =3.0.0, =0.1.0, =1.3.8, =0.63, =2.5, =1.0.3, =4.0.1, =4.0.1, =4.0.1...

URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

Impact What kind of vulnerability is it? Who is impacted? Open redirect vulnerability - a maliciously crafted link to the login form and login functionality could redirect the browser to a different website. Patches Has the problem been patched? What versions should users upgrade to? The problem...

Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager

Impact What kind of vulnerability is it? Who is impacted? Information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. Patches Has the problem been patched? What versions should users upgrade to? The problem has...

Eclipse Jetty DoS Vulnerability (GHSA-m394-8rww-3jr7) - Linux

Eclipse Jetty is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty";...

GHSA-288C-CQ4H-88GQ vulnerabilities

Vulnerabilities for packages: hive...

Fedora 32 : python-cairosvg (2021-8537865fb5)

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-8537865fb5 advisory. - security fix for GHSA-hq37-853p-g5cf: Regular Expression Denial of Service REDoS, rated as moderate severity published 17 hours ago by liZe...

CVE-2021-21248

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

Remote code execution

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default when not using SafeConstructor allows the...

CVE-2021-21244

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation...

CVE-2021-21248

CVE-2021-21248 affects OneDev before 4.0.3. The vulnerability lies in the build endpoint parameters via InputSpec, which uses dynamically generated Groovy classes; an attacker who controls job parameters can inject Groovy code, leading to arbitrary code execution through a static constructor on t...

CVE-2021-21244 Pre-Auth SSTI via Bean validation message tampering

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation...

@agentlab/ldkg-ui-react (>=0.1.7, <=0.1.12), @belvoly-vue-aioa/tinymce (>=0.1.6, <=0.1.9) +56 more potentially affected by unknown CVE via tinymce (>=5.0.6, <=5.5.1)

tinymce NPM version =5.0.6, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.18.0, =0.0.1-alpha.9, =15.0.1, =1.2.2, =0.17.0, =0.1.0, =0.0.1, =0.0.4 - @yanghp/amis 1.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H96F-FC7C-9R55...

CVE-2020-26294

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...

Code injection

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's env function to retrieve...