[SECURITY] [DLA 3647-1] trapperkeeper-webserver-jetty9-clojure

Debian LTS Advisory DLA-3647-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 07, 2023 https://wiki.debian.org/LTS Package : trapperkeeper-webserver-jetty9-clojure Version : 1.7.0-2+deb10u2 Debian Bug : 1055348 The recent update of jetty9, released as DL...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data. If a server can deserialize objects from an untrusted source, it is possible to craft a serialized object that runs arbitrary code on deserialization. Note: The attacker would likely need to be in a...

CVE-2023-28628

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

Design/Logic Flaw

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

CVE-2023-28628

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

CVE-2023-28628 `authority-regex` returns the wrong authority in lambdaisland/uri

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

CVE-2023-28628 `authority-regex` returns the wrong authority in lambdaisland/uri

lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 authority-regex allows an attacker to send malicious URLs to be parsed by the lambdaisland/uri and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in questio...

CVE-2023-28628

CVE-2023-28628 affects lambdaisland/uri (Clojure/ClojureScript) prior to 1.14.120, where authority-regex does not correctly handle backslashes in usernames, causing the library to parse and report an incorrect host (e.g., payload https://[email protected] returns host google.com instead of e...

CVE-2022-36007

Venice (com.github.jlangch:venice) contains a Partial Path Traversal flaw in the load-file and load-resource functions. When given absolute paths whose name prefix matches a configured load path (e.g., "/Users/foo/resources"), an attacker can access files outside the intended directory (e.g., "/U...

CVE-2022-36007: Improper Limitation of a Pathname to a Restricted Directory

Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions load-file and load-resource. These functions can be limited to load files from a list of load paths. Assuming Venice has been configured with the lo...

Malicious code in the-clojure-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1f0ca1f9db86d35e1c7bcc2ed22659d1986de5c3852fac7f6931f9be868dc58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fun-map Resource Management Error Vulnerability

fun-map is a Clojure string mapping utility program. A security vulnerability exists in fun-map 3.3.1 and earlier versions. The vulnerability can be exploited to add or modify Object.prototype properties via the "assocInM" function...

Best Self Hosted Alternatives

Best Self Hosted Alternatives Analytics AWStats Generates web, streaming, ftp or mail server statistics graphically. Source Code GPLv3 Perl Countly Real time mobile & web analytics, crash reporting and push notifications platform. Source Code AGPLv3 Javascript Druid A distributed, column-oriented...