Vulnerabilities

TI-2018-16102 CVE-2018-1000883 · GHSA-9h73-w7ch-rh73

Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that…

LOW 31

Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01131 Published 2018-12-20 Fixed in 1.0.6, 1.1.9 +2 CWE-20

TI-2017-14394 CVE-2017-1000053 · GHSA-5v4m-c73v-c7gq

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code…

LOW 39

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01934 Published 2017-07-13 Fixed in 1.0.4, 1.1.7 +2 CWE-502

TI-2017-14393 CVE-2017-1000052 · GHSA-2q6v-32mr-8p8x

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection…

LOW 34

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00423 Published 2017-07-13 Fixed in 1.0.4, 1.1.7 +2 CWE-74

Vulnerabilities

Filters

Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that…

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code…

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection…