Open Source Vulnerabilities

gitea-fips

Cross Site Scripting (XSS) vulnerability exists in Gitea before 1

bind

This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero

gitlab-runner-fips

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3

py3-pillow, py3.10-pillow

issue was discovered in Pillow before 8

gitea-fips

Authentication Bypass vulnerability exists in Gitea before 1

bind

BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query

py3-pillow, py3.10-pillow

issue was discovered in Pillow before 8

gitea-fips

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1

bind

Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory

zsh

zsh through version 5

py3-pillow, py3.10-pillow

issue was discovered in Pillow before 8

gitea-fips

Gitea before 1

bind

flaw in the networking code handling DNS-over-TLS queries may cause `named` to terminate unexpectedly due to an assertion failure

grafana, prometheus-fips, kumactl, kumactl

vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2

zsh

Zsh before version 5

bind

code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing

py3-pillow, py3.10-pillow

issue was discovered in Pillow before 8

gitea-fips

Stack buffer overflow vulnerability in gitea 1

grafana, prometheus-fips, kumactl, kumactl

padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2

opensearch-dashboards-3-fips-dashboards-observability

zsh

In Zsh before 5

py3-pillow, py3.10-pillow

issue was discovered in Pillow before 8

gitea-fips

Gitea 1

zsh

In zsh before 5

py3-pillow, py3.10-pillow

issue was discovered in Pillow before 8

gitea-fips

avatar middleware in Gitea before 1

bind

To keep its cache database efficient, `named` running as a recursive resolver occasionally attempts to clean up the database

py3-pillow, py3.10-pillow

Pillow through 8

gitea-fips

bluemonday before 1

bind

If a resolver cache has a very large number of ECS records stored for the same name, the process of cleaning the cache database node for this name can significantly impair query performance

zziplib

Directory traversal vulnerability in ZZIPlib 0

gitea-fips

jwt-go before 4

py3-pillow, py3.10-pillow

package pillow 5

bind

bad interaction between DNS64 and serve-stale may cause `named` to crash with an assertion failure during recursive resolution, when both of these features are enabled

zziplib

issue was discovered in ZZIPlib through 0

gitea-fips

arbitrary file deletion vulnerability in Gitea v1

py3-pillow, py3.10-pillow

path_getbbox in path

bind

flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is configured, and - the resolver receives a PTR query for an ...

gitea-fips

Gitea before 1

py3-pillow, py3.10-pillow

path_getbbox in path

bind

DNS message parsing code in `named` includes a section whose computational complexity is overly high

nodetaint, gitea-fips

attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse

py3-pillow, py3.10-pillow

Pillow before 9

gitea-fips

Gitea before 1

py3-pillow, py3.10-pillow

PIL

prometheus-blackbox-exporter-fips

Prometheus Blackbox Exporter through 0

openjdk23

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization)

openjdk23

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)

superset-5.0

superset-5.0