TI-2022-13173 CVE-2022-31129 · GHSA-wc69-rhjr-hc9g
Inefficient Regular Expression Complexity in moment
Priority HIGH 72
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates.
RHSA-2022:6156
Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
Released 2022-08-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
Fixes 19 records
TI-2022-08598 CVE-2022-24785 · GHSA-8hfj-j24r-96c4
Path Traversal in Moment.js
Priority MEDIUM 54
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.
TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p
Uncontrolled Resource Consumption in promhttp
Priority MEDIUM 48
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.
TI-2021-06132 CVE-2021-23440 · GHSA-4jqc-8m5r-9rpr
Prototype pollution in set-value
Priority MEDIUM 46
This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1.
TI-2022-08493 CVE-2022-24675 · GHSA-q42m-q8hq-53rj
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
Priority MEDIUM 45
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
TI-2022-07828 CVE-2022-23806 · GHSA-8c83-vp4v-h7fq
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can…
Priority MEDIUM 45
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.
TI-2022-01520 CVE-2022-1650 · GHSA-6h5x-7c5m-7cr7
Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource
Priority MEDIUM 44
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
TI-2022-08586 CVE-2022-24772 · GHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in `node-forge`
Priority MEDIUM 41
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-11099 CVE-2022-28327 · GHSA-v5qw-m6mv-3q79
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1…
Priority MEDIUM 40
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
TI-2022-08585 CVE-2022-24771 · GHSA-cfm4-qjh2-4765
Improper Verification of Cryptographic Signature in node-forge
Priority MEDIUM 40
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-08727 CVE-2022-24921 · GHSA-6685-ffxp-xm6f
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
Priority LOW 39
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
TI-2022-07809 CVE-2022-23773 · GHSA-52j8-p7r3-733m
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that…
Priority LOW 38
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags.
TI-2022-07808 CVE-2022-23772 · GHSA-q99m-p7hq-5v4f
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow…
Priority LOW 38
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
TI-2022-08587 CVE-2022-24773 · GHSA-2r2c-g63r-vccr
Improper Verification of Cryptographic Signature in `node-forge`
Priority LOW 32
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2022-00171 CVE-2022-0235 · GHSA-r683-j2x4-v87g
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
Priority LOW 31
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
TI-2022-11985 CVE-2022-29526 · GHSA-p782-xgp4-8hr8
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.
Priority LOW 29
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.
TI-2022-00456 CVE-2022-0536 · GHSA-pw2r-vq6v-hr8c
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Priority LOW 29
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
TI-2022-12170 CVE-2022-29810 · GHSA-27rq-4943-qcwp
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
Priority LOW 25
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
TI-2021-06164 CVE-2021-23566 · GHSA-qrpm-p2h7-hrv2
Information exposure in nanoid
Priority LOW 25
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.