TI-2022-08538 CVE-2022-24723 · GHSA-gmv4-r438-p67f
Improper Input Validation in URI.js
Priority MEDIUM 63
URI.js is a Javascript URL mutation library.
RHSA-2022:1681
Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
Released 2022-05-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Fixes 14 records
TI-2022-08598 CVE-2022-24785 · GHSA-8hfj-j24r-96c4
Path Traversal in Moment.js
Priority MEDIUM 54
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.
TI-2021-06159 CVE-2021-23555 · GHSA-6pw2-5hjv-9pf7
Sandbox Bypass
Priority MEDIUM 47
The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the h…
TI-2022-08586 CVE-2022-24772 · GHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in `node-forge`
Priority MEDIUM 41
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-08320 CVE-2022-24450 · GHSA-g6w6-r76c-28j7
NATS nats-server before 2.7.2 has Incorrect Access Control.
Priority MEDIUM 41
NATS nats-server before 2.7.2 has Incorrect Access Control.
TI-2022-08585 CVE-2022-24771 · GHSA-cfm4-qjh2-4765
Improper Verification of Cryptographic Signature in node-forge
Priority MEDIUM 40
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-06175 CVE-2022-21803 · GHSA-6xwr-q98w-rvg7
Prototype pollution in nconf
Priority LOW 36
This affects the package nconf before 0.11.4.
TI-2021-19455 CVE-2021-43565 · GHSA-gwc9-m7rh-j2ww
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto…
Priority LOW 35
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
TI-2022-00097 CVE-2022-0155 · GHSA-74fj-2j2h-c42q
Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects
Priority LOW 34
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
TI-2022-08587 CVE-2022-24773 · GHSA-2r2c-g63r-vccr
Improper Verification of Cryptographic Signature in `node-forge`
Priority LOW 32
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-00530 CVE-2022-0613 · GHSA-gcv8-gh4r-25x6
Authorization Bypass Through User-Controlled Key in medialize/uri.js
Priority LOW 32
Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
TI-2022-01246 CVE-2022-1365
Exposure of Private Personal Information to an Unauthorized Actor in lquixada/cross-fetch
Priority LOW 31
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.
TI-2022-00171 CVE-2022-0235 · GHSA-r683-j2x4-v87g
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
Priority LOW 31
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
TI-2022-00456 CVE-2022-0536 · GHSA-pw2r-vq6v-hr8c
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Priority LOW 29
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.