Open Source Vulnerabilities

chromium

chromium

chromium

Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)

asn1c: ASAN crash with decode of open types

rancher-agent

Security fix for GHSA-gcjh-h69q-9w9g applied in: rancher-agent 2.13.7-r1

rancher-agent

Security fix for GHSA-vh4v-2xq2-g5cg applied in: rancher-agent 2.13.7-r1

rancher-agent

oras-go is a Go library for managing OCI artifacts

rancher-agent

oras-go is a Go library for managing OCI artifacts

rancher-agent

oras-go is a Go library for managing OCI artifacts

rancher-agent

oras-go is a Go library for managing OCI artifacts

rancher-agent

Security fix for GHSA-259r-337f-4rfw applied in: rancher-agent 2.13.7-r1

rancher-agent

OpenTelemetry-Go is the Go implementation of OpenTelemetry

prometheus-pushgateway-fips, prometheus-pushgateway-fips

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

prometheus-pushgateway-fips, prometheus-pushgateway-fips

Previously, resolving relative paths containing parent directory ('

prometheus-pushgateway-fips, prometheus-pushgateway-fips

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

prometheus-pushgateway-fips, prometheus-pushgateway-fips

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

prometheus-pushgateway-fips, prometheus-pushgateway-fips

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

prometheus-pushgateway-fips, prometheus-pushgateway-fips

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

prometheus-pushgateway-fips

ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

adminneo-org/adminneo

AdminNeo: version-cache array injection causes persistent denial of service

AdminNeo: version-cache array injection causes persistent denial of service

Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History

NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid

knative-operator-fips-1.24

knative-operator-fips-1.24

Crass: Non-ASCII characters cause superlinear CPU consumption

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to de...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free in WebGL extensions could have led to a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

executable file warning was not presented when downloading

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

missing check related to tex units could have led to a use-after-free and potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Regular expressions used to filter out forbidden properties and values from style directives in calls to `console

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox < 109, Firefox ESR < 102

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call ...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Memory safety bugs present in Firefox ESR 102

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mmemory safety bugs present in Firefox 109 and Firefox ESR 102

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

After downloading a Windows <code>

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Security fix for CVE-2023-25732 applied in: firefox-esr 102.8.0-r0