Open Source Vulnerabilities

github.com/blevesearch/bleve, github.com/blevesearch/bleve/v2

No access control in github.com/blevesearch/bleve and bleve/v2

helm.sh/helm/v3

Repository credentials passed to alternate domain in helm.sh/helm/v3

github.com/nats-io/jwt

Incorrect handling of credential expiry in github.com/nats-io/jwt

github.com/prometheus/client_golang

Uncontrolled resource consumption in github.com/prometheus/client_golang

github.com/google/go-attestation

Improper input validation in github.com/google/go-attestation

github.com/graph-gophers/graphql-go

Panic via malicious inputs in github.com/graph-gophers/graphql-go

stdlib, golang.org/x/net

Unbounded memory growth in net/http and golang.org/x/net/http2

github.com/opencontainers/runc

Namespace restriction bypass in github.com/opencontainers/runc

github.com/kataras/iris/v12, github.com/kataras/iris

Directory traversal in github.com/kataras/iris and github.com/kataras/iris/v12

github.com/ethereum/go-ethereum

Panic via maliciously crafted message in github.com/ethereum/go-ethereum

github.com/ethereum/go-ethereum

Consensus flaw during block processing in github.com/ethereum/go-ethereum

github.com/cloudflare/cfrpki

Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

github.com/cloudflare/cfrpki

Panic on misconfigured IP address in github.com/cloudflare/cfrpki

github.com/cloudflare/cfrpki

Panic on NUL character in ROA in github.com/cloudflare/cfrpki

github.com/cloudflare/cfrpki

Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

github.com/cloudflare/cfrpki

Insufficient validation in github.com/cloudflare/cfrpki

github.com/satori/go.uuid

Insufficient randomness in UUIDs in github.com/satori/go.uuid

stdlib, golang.org/x/net

Panic due to large headers in net/http and golang.org/x/net/http/httpguts

stdlib

Denial of service in chain verification in crypto/x509

distributed

Workers for local Dask clusters mistakenly listened on public interfaces

github.com/cilium/cilium, github.com/cilium/cilium

Cilium host policy bypass in endpoint-routes mode with dual-stack

shescape

Shescape vulnerable to insufficient escaping of whitespace

shescape

Shescape prior to 1.5.8 vulnerable to insufficient escaping of line feeds for CMD

wintercms/winter, wintercms/winter

Bypass of CMS Safe Mode Security Feature

io.undertow:undertow-core

Undertow vulnerable to Denial of Service (DoS) attacks

io.undertow:undertow-core, io.undertow:undertow-core

Undertow vulnerable to memory exhaustion due to buffer leak

packbackbooks/lti-1-3-php-library

LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0

packbackbooks/lti-1-3-php-library

LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0

org.togglz:togglz-console

Togglz console missing cross-site request forgery (CSRF) protection

com.amazonaws:aws-java-sdk-s3

Partial Path Traversal in com.amazonaws:aws-java-sdk-s3

angular.js, angular.js

node-terser, node-terser, node-terser

golang

CVE-2022-30634 affecting package golang 1.27.1-1

js-jquery

CVE-2022-25858 affecting package js-jquery 3.5.0-4

uglify-js

CVE-2022-25858 affecting package uglify-js for versions less than 3.19.3-11

kured

CVE-2022-25891 affecting package kured for versions less than 1.13.2-1

golang

CVE-2022-30634 affecting package golang 1.25.7-1

angular.js, angular.js, angular.js, angular.js, angular.js, angular.js, angular.js, angular.js

node-terser, node-terser, qt6-webengine, node-terser, qt6-webengine, node-terser, qt6-webengine, node-terser, qt6-webengine, node-terser, qt6-webengine

CVE-2022-30634 does not affect BellSoft software