Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through hook file handling. An attacker can access or manipulate files outside the hooks directory by supplying a hook filename containing directory-escape sequences such as ../ when editing or removing a hook. This...

User Impersonation

Overview @libp2p/peer-store is a Stores information about peers libp2p knows on the network Affected versions of this package are vulnerable to User Impersonation via consumePeerRecord in peer-store/src/index.ts, where the peer ID derived from the envelope's signing public key is compared against...

Information Exposure

Overview Steeltoe.Management.Endpoint is a package that provides building blocks for development of .NET applications that integrate with Spring and Spring Boot environments, as well as Cloud Foundry and Kubernetes with first-party support for Tanzu. Affected versions of this package are vulnerab...

Missing Release of Memory after Effective Lifetime

Overview @libp2p/floodsub is a libp2p-floodsub, also known as pubsub-flood or just dumbsub, this implementation of pubsub focused on delivering an API for Publish/Subscribe, but with no CastTree Forming it just floods the network. Affected versions of this package are vulnerable to Missing Releas...

Improper Verification of Cryptographic Signature

Overview @libp2p/gossipsub is an A typescript implementation of gossipsub Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the validateToRawMessage process. An attacker can cause messages to be accepted and propagated as if authored by a vict...

Improper Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions through the JsonInstanceInfoConverter in src/Discovery/src/Eureka/Transport/JsonInstanceInfoConverter.cs. An attacker can prevent Eureka registry fetches from succeeding by registering or...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information through proxy-auth handling in NettyRequestFactory.newNettyRequest and...

Improper Resource Shutdown or Release

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Resource Shutdown or Release due to NettyConnectListener.onSuccess in the Netty connect path. An attacker can exhaust maxConnections...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect authentication path in Interceptors.java. An attacker can obtain client-wide realm...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the newNettyRequest and writeRequest/sendRequestWithNewChannel paths in NettyRequestFactory and...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through ChannelManager.newHttpContentDecompressor in...

Detection of Error Condition Without Action

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Detection of Error Condition Without Action via the SCRAM processScramAuthenticationInfo path and the Digest processAuthenticationInfo path i...

Command Injection

Overview SSH.NET is a Secure Shell SSH library for .NET, optimized for parallelism and with broad framework support. Affected versions of this package are vulnerable to Command Injection through the default remote-path handling in ScpClient constructors and initialization in...

Directory Traversal

Overview com.github.junrar:junrar is a rar decompression library in plain java. Affected versions of this package are vulnerable to Directory Traversal due to unchecked intermediate directory creation in LocalFolderExtractor’s makeFile path handling. An attacker can create directories outside the...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the format and formatmap functions of Python string subclasses. An attacker can access sensitive information by supplying crafted format strings that leverage unrestricted attribute and item access...

Infinite loop

Overview exifreader is a Library that parses Exif metadata in images. Affected versions of this package are vulnerable to Infinite loop via a malformed ISO-BMFF iloc box in HEIC/AVIF files, parsed by parseItemLocationBox in src/image-header-iso-bmff-iloc.js. When the declared extentCount field in...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass through the ClientMessage server-initiated LOCAL INFILE handling in src/main/java/org/mariadb/jdbc/message/ClientMessage.java. An attacker can make the client send a local file by replying to a LOAD DATA LOCAL INFI...

Missing Authorization

Overview Umbraco.Cms.Api.Delivery is a presentation layer for the Umbraco CMS Delivery API. Affected versions of this package are vulnerable to Missing Authorization in the Content Delivery API, which enforces Public Access protection only on directly requested nodes, expanding Content Picker and...

Missing Authorization

Overview Umbraco.Cms.Web.Common is a package containing the web assembly needed to run Umbraco CMS. Affected versions of this package are vulnerable to Missing Authorization in the Content Delivery API, which enforces Public Access protection only on directly requested nodes, expanding Content...

Information Exposure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure in the util.getCallSites function. An attacker can access sensitive information from the host environment, such as absolute file...

Information Exposure

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure in the util.getCallSites function. An attacker can access sensitive information from the host environment, such ...

Incorrect Permission Assignment for Critical Resource

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the tls module. An attacker can modify the process-wide certificate authorities by invoking...

Incorrect Permission Assignment for Critical Resource

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the tls module. An attacker can modify the process-wide certificate...

Denial of Service (DoS)

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Denial of Service DoS through the FinalizationRegistry process. An attacker can cause the host event loop to be blocked for an unbounded period by...

Denial of Service (DoS)

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Denial of Service DoS through the FinalizationRegistry process. An attacker can cause the host event loop to be blocked for an...

Arbitrary Code Injection

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection in the handling of rejected host Promises via call or apply indirection. An attacker can execute arbitrary commands with the...

Arbitrary Code Injection

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection in the handling of rejected host Promises via call or apply indirection. An attacker can execute arbitrary...

Exposure of Resource to Wrong Sphere

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the globalAgent process. An attacker can access sensitive HTTPS credentials and intercept or manipulate...

Improper Control of Dynamically-Managed Code Resources

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the NodeVM process when an array-shaped require value is supplied with nesting enabled. An...

Exposure of Resource to Wrong Sphere

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the globalAgent process. An attacker can access sensitive HTTPS credentials and intercept or...

Improper Control of Dynamically-Managed Code Resources

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the NodeVM process when an array-shaped require value is supplied with...

Information Exposure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the error stack formatting process. An attacker can obtain absolute host filesystem paths, including those from Node.js...

Information Exposure

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the error stack formatting process. An attacker can obtain absolute host filesystem paths, including those...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the node:sqlite module exposure within the sandbox environment when certain builtins are permitted. An attacker can...

Protection Mechanism Failure

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the node:sqlite module exposure within the sandbox environment when certain builtins are permitted. A...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the requireImpl process. An attacker can execute arbitrary JavaScript code outside the intended sandbox by supplying...

Protection Mechanism Failure

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the requireImpl process. An attacker can execute arbitrary JavaScript code outside the intended sandb...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the Promise.prototype.finally process. An attacker can execute arbitrary code by crafting an async function that...

Protection Mechanism Failure

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the Promise.prototype.finally process. An attacker can execute arbitrary code by crafting an async...

Modification of Assumed-Immutable Data (MAID)

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID in the Object.getOwnPropertyDescriptor or lookupSetter process. An attacker can modify properties that we...

Modification of Assumed-Immutable Data (MAID)

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID in the Object.getOwnPropertyDescriptor or lookupSetter process. An attacker can modify...

Use of Incorrectly-Resolved Name or Reference

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the allowlist process. An attacker can execute unauthorized code in the host context by requiring a...

Use of Incorrectly-Resolved Name or Reference

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the allowlist process. An attacker can execute unauthorized code in the host contex...

Improper Control of Dynamically-Managed Code Resources

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the mutation of TypedArray and ArrayBuffer prototypes. An attacker can alter the...

Incorrect Resource Transfer Between Spheres

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Resource Transfer Between Spheres incomplete filtering of Node.js registered internal symbols across the sandbox boundary. An attacker can...

Improper Control of Dynamically-Managed Code Resources

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the mutation of TypedArray and ArrayBuffer prototypes. An attacker can...

Incorrect Resource Transfer Between Spheres

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Incorrect Resource Transfer Between Spheres incomplete filtering of Node.js registered internal symbols across the sandbox boundary. ...

Information Exposure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the Buffer pool. An attacker can access and manipulate host memory by leveraging sandboxed code to acquire ArrayBuffers from...

Information Exposure

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the Buffer pool. An attacker can access and manipulate host memory by leveraging sandboxed code to acquire...

Improper Privilege Management

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Privilege Management in the require process. An attacker can gain unauthorized access to restricted filesystem operations by bypassing the...