GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, pulumi-kubernetes-operator, backup-restore-operator, cloudbeat-fips, crossplane-provider-aws-lightsail-fips, crossplane-provider-azure-spring, zitadel, chainloop-cli, crossplane-provider-aws-elbv2, etcd-fips, kuma, databricks-cli, packer,...

zae-limiter security vulnerabilities

Zae-limiter is a rate-limiting library open source by ZeroAE. Versions of Zae-limiter prior to 0.10.1 contained security vulnerabilities. These vulnerabilities stemmed from the fact that all rate-limiting buckets for a single entity shared the same DynamoDB partition key. This could lead to...

CVE-2021-21304

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.1.0.final), io.quarkus:io.quarkus.gradle.plugin (1.1.0.final) +415 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.1.0.final)

io.quarkus:quarkus-core MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.1.0.final - io.quarkus:io.quarkus.gradle.plugin 1.1.0.fina...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (0.28.0), io.quarkus:io.quarkus.gradle.plugin (0.28.0) +184 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (0.28.0)

io.quarkus:quarkus-core MAVEN version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 0.28.0 - io.quarkus:io.quarkus.gradle.plugin 0.28.0 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.4.final), io.quarkus:io.quarkus.gradle.plugin (1.3.4.final) +245 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.3.4.final)

io.quarkus:quarkus-core MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.4.final - io.quarkus:io.quarkus.gradle.plugin 1.3.4.fina...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.11.6.final), io.quarkus:io.quarkus.gradle.plugin (1.11.6.final) +412 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.11.6.final)

io.quarkus:quarkus-core MAVEN version 1.11.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.11.6.final - io.quarkus:io.quarkus.gradle.plugin...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.0.cr1), io.quarkus:io.quarkus.gradle.plugin (1.3.0.cr1) +243 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.3.0.cr1)

io.quarkus:quarkus-core MAVEN version 1.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.0.cr1 - io.quarkus:io.quarkus.gradle.plugin 1.3.0.cr1 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.7.0.cr1), io.quarkus:io.quarkus.gradle.plugin (1.7.0.cr1) +326 more potentially affected by CVE-2024-2700 via io.quarkus:quarkus-core (1.7.0.cr1)

io.quarkus:quarkus-core MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.7.0.cr1 - io.quarkus:io.quarkus.gradle.plugin 1.7.0.cr1 -...

Scylla Security Breach

Scylla is a ScyllaDB open source real-time big data database compatible with Apache Cassandra and Amazon DynamoDB APIs. Scylla has a security vulnerability that stems from allowing an attacker with CREATE access to elevate to higher privileges...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (0.27.0), io.quarkus:io.quarkus.gradle.plugin (0.27.0) +329 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (0.27.0)

io.quarkus:quarkus-core MAVEN version 0.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 0.27.0 - io.quarkus:io.quarkus.gradle.plugin 0.27.0 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.3.4.final), io.quarkus:io.quarkus.gradle.plugin (1.3.4.final) +245 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.3.4.final)

io.quarkus:quarkus-core MAVEN version 1.3.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.3.4.final - io.quarkus:io.quarkus.gradle.plugin 1.3.4.fina...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (0.26.0), io.quarkus:io.quarkus.gradle.plugin (0.26.0) +183 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (0.26.0)

io.quarkus:quarkus-core MAVEN version 0.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 0.26.0 - io.quarkus:io.quarkus.gradle.plugin 0.26.0 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (1.7.0.cr2), io.quarkus:io.quarkus.gradle.plugin (1.7.0.cr2) +326 more potentially affected by CVE-2023-2974 via io.quarkus:quarkus-core (1.7.0.cr2)

io.quarkus:quarkus-core MAVEN version 1.7.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 1.7.0.cr2 - io.quarkus:io.quarkus.gradle.plugin 1.7.0.cr2 -...

CVE-2022-29240 Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla

Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of...

CVE-2021-21304

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations...

Design/Logic Flaw

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations...

CVE-2021-21304

CVE-2021-21304 describes a prototype pollution vulnerability in Dynamoose, located in the internal utility method lib/utils/object/set.ts . Affected are Dynamoose versions from 2.0.0 up to 2.6.x (and v2.x beta/alpha). The vulnerability was fixed in 2.7.0 . There is no evidence of exploitation rep...

CVE-2021-21304 Prototype Pollution in Dynamoose

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations...

CVE-2021-21304: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout the codebase for various operations...