TI-2023-23372 CVE-2023-43646 · GHSA-4q6p-r6v2-jvc5
Inefficient Regular Expression Complexity in get-func-name
Priority HIGH 76
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser.
RHSA-2024:4591
Red Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update
Released 2024-07-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +8
Fixes 11 records
TI-2024-25207 CVE-2024-37890 · GHSA-3h5v-q93c-6h6q
Denial of service when handling a request with many HTTP headers in ws
Priority HIGH 72
ws is an open source WebSocket client and server for Node.js.
TI-2023-25448 CVE-2023-47108 · GHSA-8pgv-569h-w5rw
DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics
Priority HIGH 72
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.
TI-2024-19062 CVE-2024-28863 · GHSA-f5x3-32g6-xq36
node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation
Priority MEDIUM 62
node-tar is a Tar for Node.js.
TI-2024-16303 CVE-2024-24786 · GHSA-8r3f-844c-mc37
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
Priority MEDIUM 41
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.
TI-2024-01301 CVE-2024-1394 · GHSA-78hx-gp6g-7mj6
Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
Priority LOW 36
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs.
TI-2024-04683 CVE-2024-5042 · GHSA-2rhx-qhxp-5jpw
Submariner-operator: rbac permissions can allow for the spread of node compromises
Priority LOW 32
A flaw was found in the Submariner project.
TI-2024-18754 CVE-2024-28176 · GHSA-hhhv-q57g-882q
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
Priority LOW 31
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.
TI-2024-16300 CVE-2024-24783 · GHSA-3q2c-pvp5-3cqp
Verify panics on certificates with an unknown public key algorithm in crypto/x509
Priority LOW 28
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.
TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Priority LOW 26
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.
TI-2024-16302 CVE-2024-24785 · GHSA-j6m3-gc37-6r6q
Errors returned from JSON marshaling may break template escaping in html/template
Priority LOW 26
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected…