TI-2024-14290 CVE-2024-21534 · GHSA-pppg-cpfq-h7wr
Code injection in jsonpath-plus
Priority HIGH 82
All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.
RHSA-2024:10236
Red Hat OpenShift Dev Spaces 3.17.0 release
Released 2024-11-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces/udi-rhel8
Fixes 9 records
TI-2023-22552 CVE-2023-42282 · GHSA-78xj-cgh5-2h22
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such…
Priority HIGH 82
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
TI-2024-19451 CVE-2024-29415 · GHSA-2p57-rm9w-gvfp
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such…
Priority MEDIUM 48
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPubl…
TI-2024-32129 CVE-2024-47875 · GHSA-gx9m-whjm-85jf
DOMPurify nesting-based mXSS
Priority MEDIUM 45
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
TI-2024-30367 CVE-2024-45296 · GHSA-9wv6-86v2-598j
path-to-regexp outputs backtracking regular expressions
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
TI-2024-22606 CVE-2024-34156 · GHSA-crqm-pwhx-j97f
Stack exhaustion in Decoder.Decode in encoding/gob
Priority MEDIUM 41
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
TI-2024-32637 CVE-2024-48949 · GHSA-434g-2637-qmqr
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6…
Priority MEDIUM 40
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
TI-2024-30779 CVE-2024-45813 · GHSA-rrr8-f88r-h8q6
ReDoS vulnerability in multiparametric routes in find-my-way
Priority LOW 25
find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent.
TI-2024-22605 CVE-2024-34155 · GHSA-8xfx-rj4p-23jm
Stack exhaustion in all Parse functions in go/parser
Priority LOW 22
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.