Improper Control of Dynamically-Identified Variables

Overview Affected versions of this package are vulnerable to Improper Control of Dynamically-Identified Variables via the handling of environment variables in container images. An attacker can access sensitive host environment variables by crafting a container image with an environment variable...

EUVD-2024-19501

Malicious code in bioql PyPI...

CVE-2024-21890

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/. This misleading documentation affects all users...

keycloak: open redirect via "form_post.jwt" JARM response mode

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134...

PT-2021-21254

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.8.5 Description The issue allows incorrect usage of wildcards in the manage services.sh script. Recommendations For versions prior to 5.8.5, update to version 5.8.5 or later to resolve the issue...