Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...

Server-side Request Forgery (SSRF)

Overview @zereight/mcp-gitlab is a GitLab MCP server for projects, merge requests, issues, pipelines, wiki, releases, and more Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the X-GitLab-API-URL HTTP header when the ENABLEDYNAMICAPIURL environment variabl...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the unbounded queue used for outbound HTTP/2 frames. An attacker can exhaust server memory by continuously sending frames that trigger the server to enqueue responses faster than they are processed. Workarou...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling due to lenient parsing in the chunk decoder process. An attacker can bypass intermediary controls, poison caches, or hijack the request queue by crafting specially formatted chunked requests that exploit differenc...

Information Exposure

Overview bagisto/bagisto is a hand tailored E-Commerce framework designed on some opensource technologies such as Laravel a PHP framework, Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Information Exposure in the add-to-cart API and the downloadabl...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP message parsing process. An attacker can bypass intermediary access controls, poison caches, or cause victim requests to be joined with attacker-controlled prefixes by sending requests containing both...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HeaderP.parse process. An attacker can bypass access controls, hijack cross-user requests, or poison server caches by crafting HTTP requests with specially formatted Transfer-Encoding header values that...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker can access resources outside the configured base directory by crafting reques...

Directory Traversal

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker c...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ResourceService and WebjarService when percent-encoded slash or backslash separators in URL path segments are decoded. An attacker can access resources outside the configured base directory by crafting reques...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parsing process. An attacker can bypass front-end controls, capture another user's headers, or poison a cache by sending requests with differing duplicate Content-Length headers, especially when th...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parsing process. An attacker can bypass front-end controls, capture another user's headers, or poison a cache by sending requests with differing duplicate Content-Length headers, especially when th...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parsing process. An attacker can bypass front-end controls, capture another user's headers, or poison a cache by sending requests with differing duplicate Content-Length headers, especially when th...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the lack of enforcement of SETTINGSMAXCONCURRENTSTREAMS in HTTP/2 connections. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the lack of enforcement of SETTINGSMAXCONCURRENTSTREAMS in HTTP/2 connections. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to the lack of enforcement of SETTINGSMAXCONCURRENTSTREAMS in HTTP/2 connections. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via the CookieJar process. An attacker can access sensitive session or authentication cookies by influencing outbound requests to attacker-controlled hostnames, leading to...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via the CookieJar process. An attacker can access sensitive session or authentication cookies by influencing outbound requests to attacker-controlled hostnames, leading to...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via the CookieJar process. An attacker can access sensitive session or authentication cookies by influencing outbound requests to attacker-controlled hostnames, leading to...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the HTTP/2 flow-control process. An attacker can exhaust system memory by sending data faster than it is consumed by the application, causing unbounded buffering and potential service disruption. Details Denial ...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the HTTP/2 flow-control process. An attacker can exhaust system memory by sending data faster than it is consumed by the application, causing unbounded buffering and potential service disruption. Details Denial ...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the HTTP/2 flow-control process. An attacker can exhaust system memory by sending data faster than it is consumed by the application, causing unbounded buffering and potential service disruption. Details Denial ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the H2Connection process. An attacker can exhaust heap memory and cause service disruption by sending HTTP/2 HEADERS or PUSHPROMISE frames without ENDHEADERS, followed by unbounded...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the H2Connection process. An attacker can exhaust heap memory and cause service disruption by sending HTTP/2 HEADERS or PUSHPROMISE frames without ENDHEADERS, followed by unbounded...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the H2Connection process. An attacker can exhaust heap memory and cause service disruption by sending HTTP/2 HEADERS or PUSHPROMISE frames without ENDHEADERS, followed by unbounded...

Replay Attack

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously captured Authorization header. Workaround Users that are not able to upgrade to...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through improper handling of the DigestAuth process. An attacker can execute authenticated requests as another user by replaying a previously captured Authorization header. Workaround Users that are not able to upgrade to...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the DigestAuth process. An attacker can cause the application to exhaust system memory by repeatedly triggering unauthenticated challenges, leading to unbounded growth of the nonce...

Missing Release of Memory after Effective Lifetime

Overview org.http4s:http4s-server2.12 is a base library for building http4s servers. Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the DigestAuth process. An attacker can cause the application to exhaust system memory by repeatedly...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the DigestAuth process. An attacker can cause the application to exhaust system memory by repeatedly triggering unauthenticated challenges, leading to unbounded growth of the nonce...

Malicious Package

Overview strapi-plugin-yesccresh-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...