TI-2020-06291 CVE-2020-7774 · GHSA-c4w7-xm78-47vh
Prototype pollution in y18n
Priority HIGH 79
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
RHSA-2021:2041
Red Hat OpenShift Container Storage 4.7.0 security, bug fix, and enhancement update
Released 2021-05-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/mcg-core-rhel8, ocs4/mcg-rhel8-operator, ocs4/rook-ceph-rhel8-operator
Fixes 8 records
TI-2021-02485 CVE-2021-3528 · GHSA-3q58-8ch7-h333
Insufficiently protected credentials in NooBaa
Priority MEDIUM 40
A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files.
TI-2020-17201 CVE-2020-28362 · GHSA-gff4-9rfx-4pcw
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
Priority LOW 39
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
TI-2020-16110 CVE-2020-26289 · GHSA-r92x-f52r-x54g
Regular expression Denial of Service in date-and-time
Priority LOW 37
date-and-time is an npm package for manipulating date and time.
TI-2020-15993 CVE-2020-26160 · GHSA-w73w-5m7g-f7qc
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in…
Priority LOW 37
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification).
TI-2021-02209 CVE-2021-3114 · GHSA-gwfm-9vvh-63r3
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate…
Priority LOW 34
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
TI-2020-06863 CVE-2020-8565 · GHSA-8cfg-vx93-jvxw
Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9
Priority LOW 25
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files.
TI-2020-06130 CVE-2020-7608 · GHSA-p9pc-299p-vxgp
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
Priority LOW 25
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.