GHSA-QV95-G3GM-X542 vulnerabilities

Vulnerabilities for packages: k3d...

GHSA-289F-7MW3-2QF4

creationtimestamp| type| source ---|---|--- 2021-10-06 00:30:49+00:00| published-proof-of-concept| https://t.me/cibsecurity/30006...

Redis Stack Overflow Vulnerability (GHSA-p486-xggp-782c)

Redis is prone to a heap-based stack overflow vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if...

CVE-2021-3581

CVE-2021-3581 affects Zephyr RTOS, specifically versions 2.5.0 and later, due to a Buffer Access with Incorrect Length Value (CWE-805) . The available connected sources indicate the issue exists in Zephyr and cite a GHSA advisory; CVSS vectors from NVD point to a high impact (ISC/availability/con...

CSV injection in Craft CMS

Withdrawn Duplicate of GHSA-h7vq-5qgw-jwwq...

GHSA-3J6G-HXX5-3Q26 vulnerabilities

Vulnerabilities for packages: apache-nifi...

com.comcast.money:money-kafka_2.13 (>=0.9.1 <=0.15.1), com.consol.citrus:citrus-kafka (>=3.0.0-M2 <=3.0.0-M3) +57 more potentially affected by CVE-2021-38153 via org.apache.kafka:kafka_2.13 (>=2.4.0 <=2.6.2)

org.apache.kafka:kafka2.13 MAVEN version =2.4.0, =0.9.1, =3.0.0-M2, =1.7, =2.1.0, =3.5.1, =2.4.0, =2.5.1.2 - com.revivebird.finagle:finatra-kafka-streams-prerestore2.13 =25.11.0 and more Source cves: CVE-2021-38153 Source advisory: OSV:GHSA-3J6G-HXX5-3Q26...

ch.j3t:zio-prefetcher_2.12 (=0.8.0-RC6), com.clovellytech:h4sm-auth_2.12 (=0.0.13) +81 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.23.0 <=0.23.34)

org.http4s:http4s-server2.12 MAVEN version =0.23.0, =0.0.1, =0.12.1, =0.2.0, =7.1.0, =0.20.2, =1.1.1, =1.2.0, =1.2.0, =1.2.0, =3.3.2, =3.3.2, =1.6.29, =1.7.1 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

GHSA-93Q8-GQ69-WQMW vulnerabilities

Vulnerabilities for packages: nodejs...

0z_export (>=1.0.0 <=1.0.102), 1cli (>=0.0.1 <=0.0.2) +1492 more potentially affected by unknown CVE via mixme (>=0.0.1 <=0.5.10)

mixme NPM version =0.0.1, =1.0.0, =0.0.1, =1.0.0, =4.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.1.2, =1.3.0, =0.0.0-snapshot-20260427171625, =2.26.1-next.0, =0.0.9, =0.0.30 and more Source cves: unknown CVE Source advisory: OSV:GHSA-84P7-FH9C-6G8H...

com.barchart.http:barchart-http-handlers (>=1.0.6 <=1.0.7), com.barchart.http:barchart-http-server (>=1.0.6 <=1.0.7) +14 more potentially affected by CVE-2021-37136 via io.netty:netty (>=4.0.0.Alpha1 <=4.0.0.Alpha8)

io.netty:netty MAVEN version =4.0.0.Alpha1, =1.0.6, =1.0.6, =0.3, =0.3, =0.2, =1.3.0, =1.0.0.Alpha1, =1.0.0.Alpha2 and more Source cves: CVE-2021-37136 Source advisory: OSV:GHSA-GRG4-WF29-R9VV...

GHSA-6HW5-6GCX-PHMW vulnerabilities

Vulnerabilities for packages: k3d...

GHSA-CCW8-7688-VQX4 vulnerabilities

Vulnerabilities for packages: k3d...

ch.j3t:zio-prefetcher_2.12 (=0.8.0-RC6), com.codacy:kamon-http4s-0.23_2.12 (>=0.0.1 <=0.1.2) +54 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.12 (>=0.23.0 <=0.23.19)

org.http4s:http4s-server2.12 MAVEN version =0.23.0, =0.0.1, =0.12.1, =0.2.0, =0.20.2, =1.1.1, =1.2.0, =1.2.0, =1.2.0, =3.3.2, =3.3.2, =0.1.0, =1.0.0, =1.5.4 and more Source cves: CVE-2021-39185 Source advisory: OSV:GHSA-52CF-226F-RHR6...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185

Http4s is affected by a vulnerability in the default CORS configuration that enables origin reflection and a Null Origin Attack for versions 0.21.26 and prior, 0.22.0–0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24. The issue stems from the default CORS settings allowing credentialed acces...

GHSA-QQ89-HQ3F-393P

creationtimestamp| type| source ---|---|--- 2021-08-31 20:33:52+00:00| seen| https://t.me/cibsecurity/28114...

GHSA-GMW6-94GG-2RC2

creationtimestamp| type| source ---|---|--- 2021-08-31 20:33:48+00:00| seen| https://t.me/cibsecurity/28112...

ALPINE-CVE-2021-37712

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...