4765 matches found
Withdrawn
Withdrawn: duplicate of GHSA-wjr4-2jgw-hmv8...
coturn < 4.5.1.3 Information Disclosure Vulnerability
coturn is prone to an information disclosure vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
CVE-2020-15084
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
@10yun/cv-mobile-ui (=0.3.20), @agneta/cli (>=0.14.7 <=0.14.15) +446 more potentially affected by unknown CVE via jsrsasign (>=4.8.2 <=8.0.12)
jsrsasign NPM version =4.8.2, =0.14.7, =2.0.1-alpha.0, =1.0.0, =1.0.0, =2.0.1-alpha.0, =1.0.0, =1.0.0, =1.0.17-beta.7, =1.0.0-beta.0, =1.0.0, =0.4.1, =1.0.1, =1.0.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G753-JX37-7XWH...
GHSA-6PHF-73Q6-GH87 vulnerabilities
Vulnerabilities for packages: trino, hadoop-fips...
GHSA-MVR2-9PJ6-7W5J vulnerabilities
Vulnerabilities for packages: apache-nifi...
GHSA-MVR2-9PJ6-7W5J vulnerabilities
Vulnerabilities for packages: spark-fips, druid, hadoop-fips, spark...
@pho-nomenal/5-minute-github-demo (>=6.0.3 <=21.5.1), eject-media (>=0.0.1 <=0.0.2) +2 more potentially affected by CVE-2020-7628 via umount (=1.1.6)
umount NPM version =1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on umount and may be impacted: - @pho-nomenal/5-minute-github-demo =6.0.3, =0.0.1, =0.1.1, =1.1.0, =1.1.4 Source cves: CVE-2020-7628 Source advisory: OSV:GHSA-6Q48-VJQ2-MWCJ...
com.treelogic-swe:aws-mock (=1.0), com.treelogic-swe:cxf-stub (=ec2-2013-02-01) potentially affected by CVE-2019-17573 via org.apache.cxf:apache-cxf (=2.7.5)
org.apache.cxf:apache-cxf MAVEN version =2.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:apache-cxf and may be impacted: - com.treelogic-swe:aws-mock =1.0 - com.treelogic-swe:cxf-stub =ec2-2013-02-01 Source cves: CVE-2019-17573...
@awoyotoyin/ts-graphql-yoga-express-starter (=1.0.0), @botsbotsbots/api (>=0.1.0-latest.5b715197 <=0.1.0-latest.d90c50ea) +152 more potentially affected by CVE-2020-4038 via graphql-playground-html (>=1.4.1 <=1.6.19)
graphql-playground-html NPM version =1.4.1, =0.1.0-latest.5b715197, =0.1.0, =0.1.1, =1.0.0, =0.0.1-beta, =4.0.0, =1.0.0, =1.7.0, =1.8.81, =1.8.81, =1.8.80, =1.6.26, =1.8.175 and more Source cves: CVE-2020-4038 Source advisory: OSV:GHSA-4852-VRH7-28RF...
@aerogear/voyager-metrics (>=0.7.2-dev.409.01ecc9f.0 <=0.7.2-dev.411.7aaa5a6.0), @aerogear/voyager-server (>=0.7.2-dev.409.01ecc9f.0 <=0.9.1-dev.430.0433c35.0) +41 more potentially affected by unknown CVE via apollo-server (>=0.1.5 <=2.14.1)
apollo-server NPM version =0.1.5, =0.7.2-dev.409.01ecc9f.0, =0.7.2-dev.409.01ecc9f.0, =2018.8.28-0, =1.0.0, =0.10.0, =0.0.9, =0.0.11, =2.0.0-rc.15, =0.0.0, =1.3.1, =4.0.0-alpha-0b0eefe.499, =4.0.1-beta.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...
@axelspringer/mango-api (>=0.0.1-alpha <=1.0.0-beta.75), @carlosbajo/graphql-gateway (>=1.2.0 <=2.3.6) +39 more potentially affected by unknown CVE via apollo-server-koa (>=1.3.6 <=2.0.4)
apollo-server-koa NPM version =1.3.6, =0.0.1-alpha, =1.2.0, =2.8.1, =0.2.1, =0.2.6, =0.1.2, =6.1.0, =1.0.1, =0.0.9, =0.0.1, =1.0.3, =1.0.0, =2.8.1, =1.0.0, =1.4.56 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W42G-7VFC-XF37...
GHSA-V3XW-C963-F5HC vulnerabilities
Vulnerabilities for packages: hive...
WordPress XSS Vulnerability (May 2020) - Windows
WordPress is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress";...
ai.chronon:aggregator_2.11 (>=0.0.1 <=thread_contention-0.0.23-dev3), ai.chronon:aggregator_2.12 (>=0.0.6 <=thread_contention-0.0.23-dev3) +8879 more potentially affected by CVE-2020-11620 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0 <=2.9.10.3)
com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =0.0.1, =0.0.6, =0.0.1, =0.0.1, =thread-pool-0.0.24-dev, =local, =local, =0.0.6, =0.0.1, =threadcontention-0.0.23-dev3 - ai.genauth:genauth-java-sdk =3.1.11 - ai.ylyue:yue-library-auth-client =2.1.0 -...
GHSA-H4RC-386G-6M85 vulnerabilities
Vulnerabilities for packages: hive...
CVE-2020-11008
Technical details for CVE-2020-11008 are not present in the provided connected documents. The sources discuss related CVEs and general Git credential leakage vectors but do not specify affected versions, root cause, fixes, or exploitation status for this CVE. Monitor for updates.
Remote Code Execution (RCE) vulnerability in dropwizard-validation
Summary A server-side template injection was identified in the self-validating @SelfValidating feature of dropwizard-validation enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution RCE vulnerability. If you're using a self-validating bean via @SelfValidatin...
@agrc/helpers (>=1.0.0 <=1.0.1), @dojo/interop (>=4.0.0 <=7.0.0) +3 more potentially affected by CVE-2020-5258 via dojo (>=1.13.0 <=1.13.6)
dojo NPM version =1.13.0, =1.0.0, =4.0.0, =0.1.10, =1.13.0, =1.13.0, =1.13.10 Source cves: CVE-2020-5258 Source advisory: OSV:GHSA-JXFH-8WGV-VFR2...