Open Source Vulnerabilities

argo-workflows, argo-workflows

fast-uri before 4

cassandra-reaper-fips

Security fix for GHSA-qqpg-mvqg-649v applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-6v67-2wr5-gvf4 applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-3p8m-j85q-pgmj applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-xq3w-v528-46rv applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-389x-839f-4rhx applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-j26w-f9rq-mr2q applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-g8m5-722r-8whq applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-q4rv-gq96-w7c5 applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-4g8c-wm8x-jfhw applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Security fix for GHSA-h46c-h94j-95f3 applied in: cassandra-reaper-fips 3.8.0-r3

cassandra-reaper-fips

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS)

cassandra-reaper-fips

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS)

cassandra-reaper-fips

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization

cassandra-reaper-fips

Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0

cassandra-reaper-fips, cassandra-reaper-fips

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

cassandra-reaper-fips

Uncontrolled Recursion vulnerability in Apache Commons Lang

cassandra-reaper-fips

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter

cassandra-reaper-fips

There exists a security vulnerability in Jetty's ThreadLimitHandler

cassandra-reaper-fips

In Eclipse Jetty versions 9

cassandra-reaper-fips

Improper Access Control vulnerability in Apache Commons

cassandra-reaper-fips

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS

cassandra-reaper-fips

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1

cassandra-reaper-fips

ACE vulnerability in conditional configuration file processing by QOS

cassandra-reaper-fips

ACE vulnerability in JaninoEventEvaluator by QOS

datadog-agent-fips-7.85-serverless-init

datadog-agent-fips-7.85-serverless-init

datadog-agent-fips-7.85-serverless-init

cassandra-reaper-fips

jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor

cassandra-reaper-fips

ACE vulnerability in configuration file processing by QOS

cassandra-reaper-fips

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4

cassandra-reaper-fips

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4

cassandra-reaper-fips

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients

cassandra-reaper-fips

Security fix for GHSA-wxr5-93ph-8wr9 applied in: cassandra-reaper-fips 3.8.0-r3

kibana-9.2

stargate

Netty is an asynchronous, event-driven network application framework

activemq, cassandra-reaper-fips

In Eclipse Jetty, the HTTP/1

Zuke: Command-form registry descriptors bypass the MCP launch policy

policy-controller

Security fix for GHSA-6m8w-jc87-6cr7 applied in: policy-controller 0.12.1-r1

policy-controller

Security fix for GHSA-whqx-f9j3-ch6m applied in: policy-controller 0.12.1-r1

policy-controller

Security fix for GHSA-4qg8-fj49-pxjh applied in: policy-controller 0.12.1-r1

python-min

Distrust compromised intermediate certificates in ssl module

python

Distrust compromised intermediate certificates in ssl module

s3proxy

Security fix for GHSA-w573-9ffj-6ff9 applied in: s3proxy 3.3.0-r1

parse

Parse Server 9.0.0 before 9.10.4 Unauthenticated Class Schema Deletion on MongoDB

parse

Parse Server 9.0.0 before 9.10.4 Reserved Field Name Injection via Object Writes

parse

Parse Server 9.0.0 before 9.10.5 Authentication Bypass via AuthAdapter Subclasses

parse

Parse Server 9.0.0 before 9.10.5 Privilege Escalation via SMS MFA Login

parse

Parse Server 9.0.0 before 9.10.5 LiveQuery Information Disclosure via $or Subscriptions

temporal-server, temporal-server

writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster