Relative Path Traversal

Relative Path Traversal in ca.uhn.hapi.fhir:org.hl7.fhir.r5...

hapi-saml2 (>=3.2.0, <=3.2.1), tensor-cloudnative-express-auth (>=1.0.69, <=2.0.6) potentially affected by CVE-2022-39299 via passport-saml (3.2.0)

passport-saml NPM version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on passport-saml and may be impacted: - hapi-saml2 =3.2.0, =1.0.69, =2.0.6 Source cves: CVE-2022-39299 Source advisory: OSV:GHSA-M974-647V-WHV7...

Prototype Pollution

@hapi/hoek is vulnerable to prototype pollution. The function internals.clone allows an attacker to get control of value of “path” and modify attributes such as proto, constructor and prototype...

CVE-2020-36604

A prototype pollution flaw was found the clone function of the hapi/hoek package. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could execute arbitrary code or cause a denial of service condition on the system...

@condiments/chow-chow (>=3.0.0, <=3.0.1), @condiments/relish (>=4.0.0, <=4.0.1) +22 more potentially affected by CVE-2020-36604 via @hapi/hoek (>=8.1.0, <=8.5.0)

@hapi/hoek NPM version =8.1.0, =3.0.0, =4.0.0, =8.4.4, =1.5.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =3.0.0, =1.8.2, =1.5.0, =1.5.1 and more Source cves: CVE-2020-36604 Source advisory: OSV:GHSA-C429-5P7V-VGJP...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by CVE-2020-36604 via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves:...

hoek 安全漏洞

hoek is part of the hapi ecosystem open-sourced by hapi.js. It is designed to work seamlessly with the hapi web framework and its other components. A security vulnerability exists in hoek versions prior to 8.5.1 that stems from prototype poisoning in the clone function...

@asciidoctor/reveal.js (>=5.0.0-rc.1, <=5.0.1), hapi-reveal (4.0.0) +1 more potentially affected by CVE-2022-0776 via reveal.js (>=4.0.2, <=4.2.1)

reveal.js NPM version =4.0.2, =5.0.0-rc.1, =4.0.0-beta.0, =5.3.2 Source cves: CVE-2022-0776 Source advisory: OSV:GHSA-HHQJ-CFJX-VJ25...

GHSA-67F6-C8MX-4Q2M Uncontrolled Resource Consumption in JPA Server in HAPI FHIR

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

Uncontrolled Resource Consumption in JPA Server in HAPI FHIR

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

Uncontrolled Resource Consumption

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

The vulnerability of the @hapi/hapi application library at Aurora Center, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the @hapi/hapi application software library in Aurora Center is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow attackers to cause service failures...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

Hardcoded credentials

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

CVE-2021-32053 affects HAPI FHIR’s JPA Server prior to 5.4.0. The issue allows denial of service through history requests: a SELECT COUNT triggers a full index scan, consuming server resources and potentially disabling access to the database when many concurrent history operations occur. Connecte...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053: Uncontrolled Resource Consumption

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

HAPI FHIR 资源管理错误漏洞

HAPI FHIR is a HL7 FHIR API written in Java for individual developers. A security vulnerability exists in HAPI FHIR prior to version 5.4.0. An attacker could cause a denial of service to the program via a history request...