Vulnerabilities

TI-2024-03325 CVE-2024-3566 · GHSA-9xch-xvj3-fmf3

Command injection vulnerability in programing languages on Microsoft Windows operating system.

HIGH 82

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06827 Published 2024-04-10 No fix listed CWE-77

TI-2021-03107 CVE-2021-4249 · GHSA-r5mv-3cq3-727q

xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop

LOW 34

A vulnerability was found in xml-conduit.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00843 Published 2022-12-18 No fix listed CWE-404

TI-2022-03170 CVE-2022-3433 · GHSA-p383-f595-x4qw

The aeson library is not safe to use to consume untrusted JSON input.

LOW 30

The aeson library is not safe to use to consume untrusted JSON input.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00852 Published 2022-10-10 No fix listed CWE-328

TI-2013-00177 CVE-2013-0243 · GHSA-4q83-8359-v5v3

Improper input validation in haskell-tls-extra

LOW 35

haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.01047 Published 2019-12-05 Fixed in 0.6.1 CWE-20

Vulnerabilities

Filters

Command injection vulnerability in programing languages on Microsoft Windows operating system.

xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop

The aeson library is not safe to use to consume untrusted JSON input.

Improper input validation in haskell-tls-extra