Open Source Vulnerabilities

golang-1.8, golang-1.17

Denial of Service (DoS)

Regular Expression Denial of Service (ReDoS)

com.fasterxml.jackson.core:jackson-databind

jackson-databind vulnerable to unsafe deserialization

Indefinite hang with large buffers on Windows in crypto/rand

oro/commerce

OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

fastify-bearer-auth, @fastify/bearer-auth, @fastify/bearer-auth

fastify-bearer-auth vulnerable to Timing Attack Vector

openzeppelin-cairo-contracts

OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

openzeppelin-cairo-contracts-test

org.jvnet.hudson.main:hudson-core

Hudson XML API susceptible to External Entity Injection Vunerability prior to v3.3.2

github.com/flyteorg/flyteadmin

FlyteAdmin Insufficient AccessToken Expiration Check

OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

Partial Path Traversal in com.amazonaws:aws-java-sdk-s3

Use of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-library

Authentication Bypass by Capture-replay in packbackbooks/lti-1-3-php-library

whoogle-search

Whoogle Search Cross-site Scripting via string parameter