| Potential memory exhaustion attack due to sparse slice deserializationCVE-2024-37298 · GHSA-3669-72X9-R9P3Version ranges need review. |
github.com/gorilla/schemaRed Hat Advanced Cluster Security 3/advanced-cluster-security/rhacs-central-db-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| ip SSRF improper categorization in isPublicCVE-2024-29415 · GHSA-2P57-RM9W-GVFP |
ipRed Hat Advanced Cluster Security 3/advanced-cluster-security/rhacs-central-db-rhel8 |
npmRed Hat |
High
|
No fix reported |
|
| github.com/containers/image allows unexpected authenticated registry accessesCVE-2024-3727 · GHSA-6WVF-F2VW-3425Version ranges need review. |
github.com/containers/image/v5github.com/containers/image |
GoRed Hat |
High
|
Fix reported |
|
| pgx SQL Injection via Line Comment CreationCVE-2024-27289 · GHSA-M7WR-2XF7-CM9PVersion ranges need review. |
github.com/jackc/pgx/v4github.com/jackc/pgx |
GoRed Hat |
High
|
Fix reported |
|
| Express.js Open Redirect in malformed URLsCVE-2024-29041 · GHSA-RV95-896H-C2VC |
expressA-MQ Interconnect 1/qpid-dispatch |
npmRed Hat |
Medium
|
Fix reported |
|
| Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clientsCVE-2023-49569 · GHSA-449P-3H89-PW88Version ranges need review. |
github.com/go-git/go-git/v5gopkg.in/src-d/go-git.v4 |
GoRed Hat |
Critical
|
Fix reported |
|
| Archiver Path Traversal vulnerabilityCVE-2024-0406 · GHSA-RHH4-RH7C-7R5VVersion ranges need review. |
github.com/mholt/archiver/v3github.com/mholt/archiver |
GoRed Hat |
Medium
|
No fix reported |
|
| Maliciously crafted Git server replies can cause DoS on go-git clientsCVE-2023-49568 · GHSA-MW99-9CHC-XW7RVersion ranges need review. |
github.com/go-git/go-git/v5gopkg.in/src-d/go-git.v4 |
GoRed Hat |
High
|
Fix reported |
|
| gosaml2 vulnerable to Denial Of Service Via Deflate Decompression BombCVE-2023-26483 · GHSA-6GC3-CRP7-25W5Version ranges need review. |
github.com/russellhaering/gosaml2Red Hat Advanced Cluster Security 3/advanced-cluster-security/rhacs-main-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| http-cache-semantics vulnerable to Regular Expression Denial of ServiceCVE-2022-25881 · GHSA-RC47-6667-2J5J |
org.webjars.npm:http-cache-semanticshttp-cache-semantics |
MavennpmRed HatWordPress |
High
|
Fix reported |
|
| yaml package for Go can consume excessive amounts of CPU or memoryCVE-2022-3064 · GHSA-6Q6Q-88XP-6F2RVersion ranges need review. |
gopkg.in/yaml.v2Cryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| minimatch ReDoS vulnerabilityCVE-2022-3517 · GHSA-F8Q6-P94X-37V3 |
minimatchMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto/ssh Denial of service via crafted SignerCVE-2022-27191 · GHSA-8C26-WMH5-6G9VVersion ranges need review. |
golang.org/x/cryptoMigration Toolkit for Containers/cpma |
GoRed Hat |
High
|
Fix reported |
|
| Exposure of Sensitive Information to an Unauthorized Actor in follow-redirectsCVE-2022-0536 · GHSA-PW2R-VQ6V-HR8C |
follow-redirects.NET Core 3.1 on Red Hat Enterprise Linux/rh-dotnet31-dotnet |
npmRed Hat |
Medium
|
Fix reported |
|
| Mishandling of corrupt central directory record in archive/zipCVE-2024-24789 · GO-2024-2888 |
stdlibCustom Metric Autoscaler operator for Red Hat Openshift/custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| pgx SQL Injection via Protocol Message Size OverflowCVE-2024-27304 · GHSA-MRWW-27VC-GGHV |
github.com/jackc/pgx/v4github.com/jackc/pgx/v5 |
GoRed Hat |
High
|
Fix reported |
|
| Mattermost fails to limit the number of active sessionsCVE-2024-4183 · GHSA-WJ37-MPQ9-XRCMVersion ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost crashes web clients via a malformed custom statusCVE-2024-4182 · GHSA-8F99-G2PJ-X8W3Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost's detailed error messages reveal the full file pathCVE-2024-32046 · GHSA-VX97-8Q8Q-QGQ5Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost allows team admins to promote guests to team adminsCVE-2024-4195 · GHSA-5FH7-7MW7-MMX5Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Low
|
Fix reported |
|
