cinderlib (5.2.0), cinderlib-csi (0.0.2) +1 more potentially affected by CVE-2014-3641 via cinder (23.5.0)

cinder PYPI version 23.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on cinder and may be impacted: - cinderlib 5.2.0 - cinderlib-csi 0.0.2 - ember-csi =0.9.0rc1, =0.9.1 Source cves: CVE-2014-3641 Source advisory: OSV:GHSA-QHCH-G8QR-P497...

PT-2022-16999 · Unknown · Ember Znet Stack

Name of the Vulnerable Software and Affected Versions: Ember ZNet stack affected versions not specified Description: A malformed packet containing an invalid destination address causes a stack overflow in the Ember ZNet stack. This leads to an assert, resulting in a reset, which immediately clear...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.4) +4 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.4 Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.2) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.2)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.2 Source cves: CVE-2021-39185 Source advisory: OSV:GHSA-52CF-226F-RHR6...

com.github.gvolpe:http4s-tracer_2.11 (>=1.0-rc1, <=1.0-rc2), io.chrisdavenport:ember-server_2.11 (>=0.0.5, <=0.0.7) +6 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.19.0-m4)

org.http4s:http4s-server2.11 MAVEN version 0.19.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - com.github.gvolpe:http4s-tracer2.11 =1.0-rc1, =0.0.5, =0.0.7 - org.http4s:http4s-blaze-server2.11...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.2) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.2)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.2 Source cves: CVE-2021-39185 Source advisory: GHSA-52CF-226F-RHR6...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.2) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.2)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.2 Source cves: CVE-2021-39185 Source advisory: MEND:CVE-2021-39185...

GHSA-XHV5-W9C5-2R2W Unbounded connection acceptance in http4s-blaze-server

Impact blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an...

Unbounded connection acceptance in http4s-blaze-server

Impact blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an...

Unbounded connection acceptance leads to file handle exhaustion

Impact All servers running blaze-core = 0.14.14, including blaze-http and http4s-blaze-server users, are affected. Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request...

PT-2021-14396 · Unknown +2 · Blaze-Core +5

Name of the Vulnerable Software and Affected Versions: http4s versions prior to 0.21.17 http4s versions prior to 0.22.0-M2 http4s versions prior to 1.0.0-M14 Description: The issue is related to the blaze-core library, which accepts connections unboundedly on its selector pool. This can lead to a...

PT-2020-20952

Name of the Vulnerable Software and Affected Versions ember-power-timepicker version 1.0.8 Description The issue concerns malicious code in the ember-power-timepicker package that, when executed in a browser, can extract sensitive information such as password, cvc, and card number fields from...

PT-2020-21522

Name of the Vulnerable Software and Affected Versions ember cli babe version 6.16.0 Description The issue concerns malicious code in the ember cli babe package, designed to exploit typographical errors when installing modules. Upon installation, it downloads and executes a file from a remote...

PlayStation: Reflected XSS on transact.playstation.com using postMessage from the opening window

Report Summary: When transact.playstation.com loads it handles messages received from postMessage in the receiveMessageFromTransactClientService method. The only validation that is performed is to ensure that the referrer and origin match: javascript receiveMessageFromTransactClientService:...

Beijing Qingqi Technology Co., Ltd Ember APP has Denial of Service Vulnerability

Shimmering App for PC is a novel social software to make friends through watching movies together. There is a denial-of-service vulnerability in Ember APP, which can be exploited by attackers to cause a denial-of-service attack...

@love-open-source/ember-slider (>=0.0.2, <=1.1.10), broccoli-compass-compiler (>=0.0.1, <=0.0.6) +1 more potentially affected by CVE-2020-7635 via compass-compile (0.0.1)

compass-compile NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on compass-compile and may be impacted: - @love-open-source/ember-slider =0.0.2, =0.0.1, =0.1.0, =0.5.0 Source cves: CVE-2020-7635 Source advisory:...

Malicious Package

Overview Version 1.0.8 of ember-power-timepicker contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your...

@partygame.show/demo (>=1.0.0-alpha.0, <=1.0.0-alpha.5), ember-superstatic (>=0.6.0, <=1.0.0) potentially affected by unknown CVE via superstatic (5.0.1)

superstatic NPM version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on superstatic and may be impacted: - @partygame.show/demo =1.0.0-alpha.0, =0.6.0, =1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-WM77-Q74P-5763...

@partygame.show/demo (>=1.0.0-alpha.0, <=1.0.0-alpha.5), ember-superstatic (>=0.6.0, <=1.0.0) potentially affected by unknown CVE via superstatic (5.0.1)

superstatic NPM version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on superstatic and may be impacted: - @partygame.show/demo =1.0.0-alpha.0, =0.6.0, =1.0.0 Source cves: unknown CVE Source advisory: GHSA-WM77-Q74P-5763...

Ember.js Cross-Site Scripting Vulnerability

Tilde Ember.js is the United States Tilde company's set of JavaScript framework for creating Web applications . A cross-site scripting vulnerability exists in Ember.js. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...