We’ve disclosed 3198 vulnerabilities
by Snyk Security
Researchers
How to fix?
Upgrade curl
to version 8.4.0 or higher.
google-translate-api-browser is an A free and unlimited API for Google Translate that works in browser
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) when input to translateOptions
is accepted from the end user. An attacker can manipulate the tld
field, causing the application to generate unsafe URLs that point to local resources. This is due to the translateOptions.tld
field not being properly sanitized before being included in the Google translate URL. An attacker with control over the translateOptions
can set the tld
to a payload such as @127.0.0.1
, which results in the full URL becoming https://translate.google.@127.0.0.1/...
, where translate.google.
is the username used to connect to localhost. This allows the attacker to send requests within internal networks and the local host. If there is an HTTPS application on the internal network with a vulnerability that can be exploited via a GET call, it could be exploited using this vulnerability.
eth-abi is an eth_abi: Python utilities for working with Ethereum ABI definitions, especially encoding and decoding
Affected versions of this package are vulnerable to Denial of Service (DoS) when parsing zero-sized-types (ZST). Although allowed by the ABI specification, excessive memory can be allocated when processing malicious ZST tuples.
com.liferay:com.liferay.layout.admin.web is a portal for Liferay.
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the p_l_back_url_title
parameter on a content edit page.
Cross-site Scripting (XSS) in angularjs.core (nuget)
Regular Expression Denial of Service (ReDoS) in angularjs.core (nuget)
Regular Expression Denial of Service (ReDoS) in angularjs.core (nuget)
Regular Expression Denial of Service (ReDoS) in angularjs.core (nuget)
Command Injection in chromedriver (npm)
by Snyk Security
Researchers
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.