ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.0.3), ca.uhn.hapi.fhir:hapi-fhir-igpacks (4.0.3) +6 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (4.0.3)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.0.3 - ca.uhn.hapi.fhir:hapi-fhir-igpacks...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.7.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.7.7, <=6.2.5) +110 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (>=5.6.22, <=5.6.91)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version =5.6.22, =5.7.0, =5.7.7, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =6.2.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.7, =5.7.0, =5.7.0, =6.2.5 and more Source cves: CVE-2023-24057 Source advisory: GHSA-JQH6-9574-5X22...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (1.1.67), ca.uhn.hapi.fhir:org.hl7.fhir.validation (1.1.67) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (1.1.67)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 1.1.67 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 1.1.67 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=4.0.1), ca.uhn.hapi.fhir:hapi-fhir-converter (>=4.0.0, <=4.0.1) +7 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (4.0.0)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0,...

ca.uhn.hapi.fhir:org.hl7.fhir.validation (1.1.67) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (1.1.67)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 1.1.67 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.validation 1.1.67 Source cves: CVE-2023-24057...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.0.3), ca.uhn.hapi.fhir:hapi-fhir-converter (4.0.3) +8 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.convertors (4.0.3)

ca.uhn.hapi.fhir:org.hl7.fhir.convertors MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.convertors and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.0.3 - ca.uhn.hapi.fhir:hapi-fhir-converter...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (0.0.2), ca.uhn.hapi.fhir:org.hl7.fhir.validation (0.0.2) potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (0.0.2)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 0.0.2 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 0.0.2...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.0.3), ca.uhn.hapi.fhir:hapi-fhir-converter (4.0.3) +11 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (4.0.3)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.0.3 - ca.uhn.hapi.fhir:hapi-fhir-converter 4.0.3 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (4.1.0) +63 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (4.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver 4.1.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.2.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (4.2.0) +69 more potentially affected by CVE-2023-24057 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (4.2.0)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.2.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserv...

at.crea-doo.util.toughswitch:toughswitch (>=1.0.0, <=1.0.2), ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0, <=3.7.0) +2759 more potentially affected by CVE-2022-45047 via org.apache.sshd:sshd-core (>=0.1.0, <=2.9.1)

org.apache.sshd:sshd-core MAVEN version =0.1.0, =1.0.0, =3.3.0, =2.0.0, =1.0.3, =1.0.0, =1.0.0, =0.5.4, =0.8.0, =0.0.1-9045f42e1634ad6f74edf826b9c7c61d1a495a38, =0.8.0, =0.11, =0.12 and more Source cves: CVE-2022-45047 Source advisory: MEND:CVE-2022-45047...

hapi-saml2 (>=3.2.0, <=3.2.1), tensor-cloudnative-express-auth (>=1.0.69, <=2.0.6) potentially affected by CVE-2022-39299 via passport-saml (3.2.0)

passport-saml NPM version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on passport-saml and may be impacted: - hapi-saml2 =3.2.0, =1.0.69, =2.0.6 Source cves: CVE-2022-39299 Source advisory: GHSA-M974-647V-WHV7...

hapi-saml2 (>=3.2.0, <=3.2.1), tensor-cloudnative-express-auth (>=1.0.69, <=2.0.6) potentially affected by CVE-2022-39299 via passport-saml (3.2.0)

passport-saml NPM version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on passport-saml and may be impacted: - hapi-saml2 =3.2.0, =1.0.69, =2.0.6 Source cves: CVE-2022-39299 Source advisory: OSV:GHSA-M974-647V-WHV7...

Prototype Pollution

@hapi/hoek is vulnerable to prototype pollution. The function internals.clone allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype...

CVE-2020-36604

A prototype pollution flaw was found the clone function of the hapi/hoek package. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could execute arbitrary code or cause a denial of service condition on the system...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by CVE-2020-36604 via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves:...

@condiments/chow-chow (>=3.0.0, <=3.0.1), @condiments/relish (>=4.0.0, <=4.0.1) +22 more potentially affected by CVE-2020-36604 via @hapi/hoek (>=8.1.0, <=8.5.0)

@hapi/hoek NPM version =8.1.0, =3.0.0, =4.0.0, =8.4.4, =1.5.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =3.0.0, =1.8.2, =1.5.0, =1.5.1 and more Source cves: CVE-2020-36604 Source advisory: GHSA-C429-5P7V-VGJP...

@condiments/chow-chow (>=3.0.0, <=3.0.1), @condiments/relish (>=4.0.0, <=4.0.1) +22 more potentially affected by CVE-2020-36604 via @hapi/hoek (>=8.1.0, <=8.5.0)

@hapi/hoek NPM version =8.1.0, =3.0.0, =4.0.0, =8.4.4, =1.5.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =3.0.0, =1.8.2, =1.5.0, =1.5.1 and more Source cves: CVE-2020-36604 Source advisory: OSV:GHSA-C429-5P7V-VGJP...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by CVE-2020-36604 via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves:...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by CVE-2020-36604 via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves:...