Security
فارسی
All products

Red Hat OpenShift Data Science (RHODS)/rhods/odh-dashboard-rhel8

Red Hat · Package
37 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 npmRed Hat High Fix reported
Predictable results in nanoid generation when given non-integer valuesCVE-2024-55565 · GHSA-MWCW-C2X4-8C55 nanoidCryostat 3/io.cryostat-cryostat3 npmRed Hat Medium Fix reported
Regular Expression Denial of Service (ReDoS) in cross-spawnCVE-2024-21538 · GHSA-3XGQ-45JJ-V275 cross-spawnCryostat 3/cross-spawn npmRed Hat High Fix reported
cookie accepts cookie name, path, and domain with out of bounds charactersCVE-2024-47764 · GHSA-PXG6-PF52-XH8X cookieCryostat 3/cookie npmRed Hat Low Fix reported
JSONPath Plus Remote Code Execution (RCE) VulnerabilityCVE-2024-21534 · GHSA-PPPG-CPFQ-H7WR org.webjars.npm:jsonpath-plusjsonpath-plus MavennpmRed Hat Critical Fix reported
Denial of service in http-proxy-middlewareCVE-2024-21536 · GHSA-C7QV-Q95Q-8V27 http-proxy-middlewareCryostat 3/io.cryostat-cryostat3 npmRed Hat High Fix reported
send vulnerable to template injection that can lead to XSSCVE-2024-43799 · GHSA-M6FV-JMCG-4JFG sendCryostat 3/send npmRed Hat Low Fix reported
serve-static vulnerable to template injection that can lead to XSSCVE-2024-43800 · GHSA-CM22-4G7W-348P serve-staticCryostat 3/serve-static npmRed Hat Low Fix reported
express vulnerable to XSS via response.redirect()CVE-2024-43796 · GHSA-QW6H-VGH9-J6WX expressCryostat 3/express npmRed Hat Low Fix reported
DOMPurify allows tampering by prototype pollutionCVE-2024-45801 · GHSA-MMHX-HMJR-R674 dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 npmRed Hat High Fix reported
body-parser vulnerable to denial of service when url encoding is enabledCVE-2024-45590 · GHSA-QWCR-R2FM-QRC7 body-parserCryostat 3/body-parser npmRed Hat High Fix reported
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSSCVE-2024-43788 · GHSA-4VVJ-4CPR-P986 webpackLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel8 npmRed Hat Medium Fix reported
Server-Side Request Forgery in axiosCVE-2024-39338 · GHSA-8HC4-VH64-CXMJ axiosMigration Toolkit for Runtimes/axios npmRed Hat High Fix reported
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)CVE-2024-28180 · GHSA-C5Q2-7R4C-MV6GVersion ranges need review. github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 GoRed Hat Medium Fix reported
Express.js Open Redirect in malformed URLsCVE-2024-29041 · GHSA-RV95-896H-C2VC expressA-MQ Interconnect 1/qpid-dispatch npmRed Hat Medium Fix reported
Denial of service while parsing a tar file due to lack of folders count validationCVE-2024-28863 · GHSA-F5X3-32G6-XQ36 node-tartar npmRed Hat Medium Fix reported
follow-redirects' Proxy-Authorization header kept across hostsCVE-2024-28849 · GHSA-CXJH-PQWP-8MFP follow-redirectsCryostat 2/follow-redirects npmRed Hat Medium Fix reported
browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attackCVE-2023-46234 · GHSA-X9W5-V3Q2-3RHW browserify-signOpenShift Pipelines/openshift-pipelines/pipelines-hub-api-rhel8 npmRed Hat High Fix reported
Follow Redirects improperly handles URLs in the url.parse() functionCVE-2023-26159 · GHSA-JCHW-25XP-JWWC follow-redirectsCryostat 2/follow-redirects npmRed Hat Medium Fix reported
semver vulnerable to Regular Expression Denial of ServiceCVE-2022-25883 · GHSA-C2QF-RXJJ-QQGW semverMigration Toolkit for Applications 6/mta/mta-ui-rhel9 npmRed Hat High Fix reported