AZL-105161 CVE-2018-20677 affecting package fluent-bit 3.1.10-7

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

AZL-105263 CVE-2018-20677 affecting package pytorch 2.2.2-17

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

AZL-105146 CVE-2018-20677 affecting package ceph 18.2.2-13

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property...

AZL-98928 CVE-2018-16875 affecting package golang 1.27.1-1

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients a...

AZL-105269 CVE-2018-14042 affecting package pytorch 2.2.2-17

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip...

AZL-105152 CVE-2018-14042 affecting package fluent-bit 3.1.10-7

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip...

AZL-105143 CVE-2018-14042 affecting package ceph 18.2.2-13

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip...

AZL-98781 CVE-2017-15042 affecting package golang 1.27.1-1

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was...

AZL-98682 CVE-2017-1000097 affecting package golang 1.27.1-1

On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...

AZL-98952 CVE-2017-1000098 affecting package golang 1.27.1-1

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors...

AZL-98904 CVE-2016-5386 affecting package golang 1.27.1-1

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI...

AZL-98631 CVE-2016-3959 affecting package golang 1.27.1-1

The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service infinite loop via a crafted public key to a program that uses HTTPS client...