Open Source Vulnerabilities

exiv2, exiv2, exiv2

exiv2

CVE-2021-29457 affecting package exiv2 for versions less than 0.27.5-1

wagtail

gpac, gpac, gpac, gpac, gpac, gpac

gpac, gpac, gpac, gpac, gpac, gpac

gpac, gpac, gpac, gpac, gpac, gpac

gpac, gpac, gpac, gpac, gpac, gpac

gpac, gpac, gpac, gpac, gpac, gpac

gpac, gpac, gpac, gpac, gpac, gpac

gpac, gpac, gpac, gpac, gpac, gpac

gpac, gpac, gpac, gpac, gpac, gpac

gpac, gpac, gpac, gpac, gpac, gpac

exiv2, exiv2, exiv2

exiv2, exiv2, exiv2

clamav, clamav, clamav

clamav vulnerabilities

@curveball/a12n-server

Any logged in user could edit any other logged in user.

vyper

VVE-2021-0001: Memory corruption using function calls within arrays

vyper

VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption

jose-node-cjs-runtime

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

jose-node-esm-runtime

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime

jose-browser-runtime

Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime

jose, jose, jose

Padding Oracle Attack due to Observable Timing Discrepancy in jose

com.manydesigns:portofino-dispatcher, com.manydesigns:portofino-core

Missing validation of JWT signature in `ManyDesigns/Portofino`

matrix-sydent

Malicious users could abuse Sydent to control the content of invitation emails

matrix-sydent

SSRF in Sydent due to missing validation of hostnames

matrix-sydent

Sydent vulnerable to denial of service attack via memory exhaustion

com.vaadin:vaadin-text-field-flow, com.vaadin:vaadin-text-field-flow

Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17

com.vaadin:flow-server

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

com.vaadin:flow-server, com.vaadin:flow-server

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13

com.vaadin:flow-server

Potential sensitive data exposure in applications using Vaadin 15

com.vaadin:flow-server, com.vaadin:flow-server

Directory traversal in development mode handler in Vaadin 14 and 15-17

com.vaadin:flow-server, com.vaadin:flow-server, com.vaadin:flow-server

Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

com.vaadin:vaadin-bom, com.vaadin:vaadin-bom, com.vaadin:vaadin-server, com.vaadin:vaadin-server

Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8

com.vaadin:flow-server, com.vaadin:flow-server

OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure

com.vaadin:flow-server, com.vaadin:flow-server

Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

com.vaadin:vaadin-bom, com.vaadin:vaadin-bom, com.vaadin:vaadin-server, com.vaadin:vaadin-server

Stored cross-site scripting in Grid component in Vaadin 7 and 8

com.vaadin:vaadin-bom, com.vaadin:vaadin-server

Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7

com.vaadin:vaadin-bom, com.vaadin:vaadin-bom

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

com.vaadin:vaadin-bom, com.vaadin:vaadin-bom

Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13