Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 45

Export CSV
CVE-2023-0813

Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Network Observ Optr Network Observability
CVE-2024-43800

serve-static affected by template injection that can lead to XSS

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Serve-static Discovery Network Observ Optr and 8 more
CVE-2024-45590

body-parser vulnerable to denial of service when url encoding is enabled

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Expressjs Openjsf Redhat
Products
Body-parser Body-parser Advanced Cluster Security and 10 more
CVE-2024-43796

express vulnerable to XSS via response.redirect()

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Openjsf Redhat
Products
Express Discovery Network Observ Optr and 8 more
CVE-2024-39338

axios: axios: Server-Side Request Forgery

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

CVSS 3.1 · 4 Medium EPSS 1.2% KEV · Not listed
Vendors
Axios Redhat
Products
Axios Discovery Network Observ Optr and 5 more