We’ve disclosed3433vulnerabilities
by Snyk Security
Researchers
Snyk Vulnerability Database
The leading database for open source vulnerabilities and cloud misconfigurations.
Embedded Malicious Code
Affecting ngx-bootstrap package, versions =18.1.4 , =19.0.3 , =19.0.4 , =20.0.3 , =20.0.4 , =20.0.5 , =20.0.6
How to fix?
Avoid using all malicious instances of the ngx-bootstrap package.
Vulnerabilities from the last week
Server-side Request Forgery (SSRF)
Affects
ip is a Node library.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the ip.isPublic() and ip.isPrivate() functions. An attacker can interact with internal network resources by supplying specially crafted IP address such as octal localhost format ("017700000001") that is incorrectly identified as public.
Note:
This issue exists because of an incomplete fix for CVE-2024-29415.
Missing Release of Memory after Effective Lifetime
Affects
PyMuPDF is an A high performance Python library for data extraction, analysis, conversion & manipulation of PDF (and other) documents.
Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime through the /pdf/pdf-font-add.c component. An attacker can obtain sensitive information by exploiting a memory leak issue.
Improper Encoding or Escaping of Output
org.webjars.npm:element-plus is an A Component Library for Vue 3
Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious sites, or conduct phishing attacks by supplying crafted URLs containing dangerous protocols or destinations.
Recent vulnerabilities disclosed by Snyk
- L
Cross-site Scripting (XSS) in jsondiffpatch (npm)- H
Prototype Pollution in @nyariv/sandboxjs (npm)- C
SQL Injection in z-push/z-push-dev (composer)- H
Server-Side Request Forgery (SSRF) in ssrfcheck (npm)- H
About Snyk
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.
