GHSA-289F-7MW3-2QF4

creationtimestamp| type| source ---|---|--- 2021-10-06 00:30:49+00:00| published-proof-of-concept| https://t.me/cibsecurity/30006...

Redis Stack Overflow Vulnerability (GHSA-p486-xggp-782c)

Redis is prone to a heap-based stack overflow vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if...

CVE-2021-3581

CVE-2021-3581 affects Zephyr RTOS, specifically versions 2.5.0 and later, due to a Buffer Access with Incorrect Length Value (CWE-805) . The available connected sources indicate the issue exists in Zephyr and cite a GHSA advisory; CVSS vectors from NVD point to a high impact (ISC/availability/con...

CSV injection in Craft CMS

Withdrawn Duplicate of GHSA-h7vq-5qgw-jwwq...

GHSA-3J6G-HXX5-3Q26 vulnerabilities

Vulnerabilities for packages: apache-nifi...

GHSA-93Q8-GQ69-WQMW vulnerabilities

Vulnerabilities for packages: arangodb...

GHSA-6HW5-6GCX-PHMW vulnerabilities

Vulnerabilities for packages: k3d...

GHSA-CCW8-7688-VQX4 vulnerabilities

Vulnerabilities for packages: k3d...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185

Http4s is affected by a vulnerability in the default CORS configuration that enables origin reflection and a Null Origin Attack for versions 0.21.26 and prior, 0.22.0–0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24. The issue stems from the default CORS settings allowing credentialed acces...

GHSA-QQ89-HQ3F-393P

creationtimestamp| type| source ---|---|--- 2021-08-31 20:33:52+00:00| seen| https://t.me/cibsecurity/28114...

GHSA-GMW6-94GG-2RC2

creationtimestamp| type| source ---|---|--- 2021-08-31 20:33:48+00:00| seen| https://t.me/cibsecurity/28112...

DEBIAN-CVE-2021-37712

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...

ALPINE-CVE-2021-37712

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...

CVE-2021-39135

@npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder...

CVE-2021-37712

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...

CVE-2021-37701

The npm package "tar" aka node-tar before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieve...

CVE-2021-37701

The npm package "tar" aka node-tar before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieve...

CVE-2021-39135

CVE-2021-39135 affects the Node.js npm arborist module, which builds dependency trees and writes into node_modules. The issue arises if the root project’s node_modules folder (or a dependency’s) is replaced with a symbolic link, allowing a local attacker to write package dependencies to an arbitr...