Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via incomplete cleanup of uploaded files when a request is aborted before the storage engine assigns a file path. When an upload is aborted mid-flight, the finishAbort function in make-middleware.js snapshots only...

Improper Protection of Alternate Path

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to the blocklist mechanism operating at the import system level rather than accounting for the complete Python runtime. An attacker can...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read due to improper handling of padding in the extradata allocation process within WMA encoding. An attacker can cause a denial of service by triggering an out-of-bounds read through specially crafted input data...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the MOV parsing in movreadiacb due to insufficient padding of extradata. An attacker can cause a denial of service by triggering an out-of-bounds read when processing specially crafted MOV files. Remediation Upgrad...

Allocation of Resources Without Limits or Throttling

Overview org.java-websocket:Java-WebSocket is a barebones WebSocket server and client implementation written in 100% Java. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the processFrameContinuousAndNonFin function in Draft6455.java of...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the compile and merge functions in lib/messages.js, where passing proto as a top-level error-code key or as a language-scoped sub-key to the .messages API triggers the legacy proto accessor on plain-object...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the compile and merge functions in lib/messages.js, where passing proto as a top-level error-code key or as a language-scoped sub-key to the .messages API triggers the legacy proto accessor on plain-object...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in its address parser src/addressparser/index.ts, whose join condition evaluates partsparts.length - 1.slice-1 before the...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the Snappy.uncompressByteBuffer, ByteBuffer method in org/xerial/snappy/Snappy.java. An attacker can trigger JVM termination by supplying valid compressed input that expands beyond the destination ByteBuffer...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the ZstdDictDecompressbyte dict, int offset, int length constructor in src/main/java/com/github/luben/zstd/ZstdDictDecompress.java. An attacker can read past the end of the supplied dictionary array by providi...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the transcription due to improper validation of audio sample rate headers. An...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the loadaudiopyav. An attacker can exhaust system memory by submitting a small, highly...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via MessageUnpacker.skipValue in msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java. An attacker can desynchronize the parser and cause attacker-controlled data to be returned in place of lat...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion due to recursive deserialization in MessageUnpacker.unpackValue in msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java. An attacker can trigger StackOverflowError by supplying MessagePack payloads wit...

Arbitrary Code Injection

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Arbitrary Code Injection in the LlavaOnevision2 loader due to improper handling of the trustremotecode parameter. An attacker can execute arbitrary...

Arbitrary Argument Injection

Overview aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio. Affected versions of this package are vulnerable to Arbitrary Argument Injection in the parseaddress function of src/aiosmtplib/email.py, which returns parsedaddress or address.strip, so a malformed mailbox...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without verifying that the result remains...

Command Injection

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters,...

Relative Path Traversal

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without verifying that the result remains...

Relative Path Traversal

Overview projen is a CDK for software projects Affected versions of this package are vulnerable to Relative Path Traversal in the manifest cleanup routine that processes .projen/files.json during synthesis, which resolves each manifest entry against the project directory with path.resolve without...

Allocation of Resources Without Limits or Throttling

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the CoreXMLDeserializers.Std.deserialize path in src/main/java/com/fasterxml/jackson/databind/ext/CoreXMLDeserializers.java. An attacker can consume excessive CPU by supplying a...

XML External Entity (XXE) Injection

Overview software.amazon.jdbc:aws-advanced-jdbc-wrapper is an Amazon Web Services AWS Advanced JDBC Wrapper Affected versions of this package are vulnerable to XML External Entity XXE Injection via the CachedSQLXML.getSource path in...

Unchecked Return Value

Overview Affected versions of this package are vulnerable to Unchecked Return Value in the tarfile when extracting an archive containing a link on systems that do not support links. An attacker can create or modify arbitrary files on the system by bypassing intended security restrictions during t...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via improper cleanup of the zlib compression stream when a client disconnects before the response finishes. The onResponseClose handler was absent, leaving native zlib handles unrelease...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via improper cleanup of the zlib compression stream when a client disconnects before the response finishes. The onResponseClose handler was absent, leaving native zlib handles unrelease...

Uncaught Exception

Overview hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Uncaught Exception in its async helper output escaping, where a helper value carrying a truthy but non-callable toHTML property causes handlebars' escapeExpression to invoke it ...

Improper Output Neutralization for Logs

Overview org.webjars.npm:morgan is a HTTP request logger middleware for node.js. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the escapeLogField function. An attacker can manipulate log entries by injecting unescaped double quotes into HTTP heade...

Improper Output Neutralization for Logs

Overview morgan is a HTTP request logger middleware for node.js. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the escapeLogField function. An attacker can manipulate log entries by injecting unescaped double quotes into HTTP headers such as...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:multiparty is a multipart/form-data parser which supports streaming Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its part header handling, which bounds accumulated field values and file sizes but places no lim...

Allocation of Resources Without Limits or Throttling

Overview multiparty is a multipart/form-data parser which supports streaming Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its part header handling, which bounds accumulated field values and file sizes but places no limit on the size o...

Prototype Pollution

Overview isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affected versions of...

Prototype Pollution

Overview org.webjars.npm:isomorphic-git is a pure JavaScript reimplementation of git that works in both Node.js and browser JavaScript environments. It can read and write to git repositories, fetch from and push to git remotes such as GitHub, all without any native C++ module dependencies. Affect...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling due to incomplete validation of request Transfer-Encoding headers. An...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to negative length validation in readbyte, int, int in src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java. An attacker can spin a caller thread indefinitely by supplying a negative len to read, which...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the getFrameContentSizebyte, int, int, boolean bounds check in src/main/java/com/github/luben/zstd/Zstd.java. An attacker can trigger a JVM crash or read past the start of the input buffer by supplying a negative...

Improper Encoding or Escaping of Output

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the domino dependency used for server-side rendering, where a vulnerability in the underlying DOM implementation...

Server-side Request Forgery (SSRF)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URL resolution process. An attacker can cause requests to be sent to an attacker-controlled origin and exfiltrate...

Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the HttpTransferCache process. An attacker can access sensitive user-specific information by exploiting a scenario where a child HttpClient delegates requests to a parent client that...

Cross-site Scripting (XSS)

Overview @angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via incorrect computation of security contexts for host bindings. The ingestHostBinding function and the sanitizer resolution pipeline fail to evaluate security contexts against the concrete host element,...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input due to unvalidated length and capacity fields in MergingDigest.fromBytes in core/src/main/java/com/tdunning/math/stats/MergingDigest.java. An attacker can abort the parsing thread by...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the GitLab pagination handling, which follows the URL given in a Link header and attaches the GitLab credentials to the next-page request without confining the follow to the original...

Open Redirect

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect via the Link header when following pagination links from a server response. An attacker can obtain configured credentials by manipulating the Link header to redirect requests to an...

Command Injection

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Command Injection in the manager/gradle-wrapper process. An attacker can execute arbitrary commands as the Renovate user by supplying a crafted distributionUrl value in the gradle-wrapper.properties fil...

Command Injection

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Command Injection in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. An attacker can execute arbitrary commands as the...