Red Hat Security AdvisoryRHSA-2025:1249
updated discovery container images
Released 2025-02-10 · Red Hat rating Important · View on Red Hat →
Fixes 25 records
Priority CRITICAL 88KEV
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
CVSS 3.1MEDIUM 6.9· Network · No auth · User interaction · EPSS 0.84887 · Published 2020-04-29 · Partial fix · 3.5.0, 4.4.0 CWE-79
Priority HIGH 77
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00868 · Published 2024-11-08 · Partial fix · 6.0.6, 7.0.5 +1 CWE-1333
Priority HIGH 77
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.01034 · Published 2024-10-19 · Partial fix · 2.0.7, 3.0.3 CWE-400
Priority HIGH 73
Redis is an open source, in-memory database that persists on disk.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04458 · Published 2024-10-07 · Partial fix · 6.2.16, 7.2.6 +1 CWE-121
Priority HIGH 66
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01207 · Published 2024-08-09 · Partial fix · 1.7.4 CWE-918
Priority MEDIUM 62
Webpack is a module bundler.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00959 · Published 2024-08-27 · Partial fix · 5.94.0 CWE-79
Priority MEDIUM 62
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks.
CVSS 3.1MEDIUM 6.4· Network · No auth · User interaction · EPSS 0.00494 · Published 2024-07-11 · Partial fix CWE-79
Priority MEDIUM 54
Redis is an open source, in-memory database that persists on disk.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08182 · Published 2025-01-06 · Partial fix · 7.4.2, 7.2.7 +1 CWE-416
Priority MEDIUM 52
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01503 · Published 2024-08-07 · Partial fix · 5.0.8, 4.2.15 CWE-89
Priority MEDIUM 42
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01388 · Published 2024-12-06 · Partial fix · 5.1.4, 4.2.17 +1 CWE-770
Priority MEDIUM 41
An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01277 · Published 2025-01-14 · Partial fix · 4.2.18, 5.0.11 +1 CWE-770
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00787 · Published 2024-12-05 · Partial fix · 0.1.12 CWE-1333
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00932 · Published 2024-09-09 · Partial fix · 0.1.10, 8.0.0 +3 CWE-1333
Priority MEDIUM 41
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00954 · Published 2024-08-07 · Partial fix · 5.0.8, 4.2.15 CWE-130
Priority MEDIUM 41
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.012 · Published 2024-08-07 · Partial fix · 5.0.8, 4.2.15 CWE-400
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
Priority LOW 32
An issue was discovered in PostCSS before 8.4.31.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00973 · Published 2023-09-29 · Partial fix · 8.4.31 CWE-74
Priority LOW 31
Redis is an open source, in-memory database that persists on disk.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01011 · Published 2024-10-07 · Partial fix · 6.2.16, 7.2.6 +1 CWE-674
Priority LOW 27
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00522 · Published 2024-12-23 · Partial fix · 3.1.5 CWE-1336
Priority LOW 26
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00307 · Published 2024-12-23 · Partial fix · 3.1.5 CWE-150
Priority LOW 24
serve-static serves static files.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00631 · Published 2024-09-10 · Partial fix · 1.16.0, 2.1.0 CWE-79
Priority LOW 24
Send is a library for streaming files from the file system as a http response.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00541 · Published 2024-09-10 · Partial fix · 0.19.0 CWE-79
Priority LOW 24
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00271 · Published 2024-09-14 · Partial fix · 1.2.0-91, 3.0.1-95 +10 CWE-532
Priority LOW 23
Express.js minimalist web framework for node.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00486 · Published 2024-09-10 · Partial fix · 4.20.0, 5.0.0 CWE-79
Priority LOW 21
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00665 · Published 2024-12-09 · Partial fix · 5.0.9, 3.3.8 CWE-835
THREATIST.IORead the docs