We’ve disclosed 2572 vulnerabilities
by Snyk Security
Researchers
Open Source Vulnerability Database
The most comprehensive, accurate, and timely database for open source vulnerabilities.
Buffer Overflow
Affecting openssl package, versions
[3.0.0,3.0.7)
How to fix?
Upgrade openssl to version 3.0.7 or higher.
Vulnerabilities from the last week
Arbitrary Code Injection
@asyncapi/modelina is a The Model SDK for generating data models
Affected versions of this package are vulnerable to Arbitrary Code Injection when using the default presets, via the constructor() in TypeScriptGenerator.
NOTE: The maintainers advise that "it is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are NOT seen as a security issue, but intended behavior."
Missing Authorization
xblock-lti-consumer is a XBlock that implements the consumer side of the LTI specification
Affected versions of this package are vulnerable to Missing Authorization in the publish_grade_on_score_update() function in signals/signals.py that allows any LTI tool that is integrated with the Open edX platform to post a grade back for any LTI XBlock, using the block location for that XBlock. The code that uploads that score to the LMS grade tables determines which XBlock to upload the grades for by reading the resource_link_id field of the associated line item, which can be controlled by an unauthorized user.
Creation of Temporary File With Insecure Permissions
io.quarkus.resteasy.reactive:resteasy-reactive-common is a RESTEasy Reactive - Common Runtime
Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions via the usage of File.createTempFile() class in the FileBodyHandler serializer that causes temp files to be created with -rw-r--r-- permissions.
Recent vulnerabilities disclosed by Snyk
- C
Malicious Package in kashm1337 (npm)
- C
Malicious Package in waffles-next-doc-site (npm)
- C
Malicious Package in so5685 (npm)
- C
Malicious Package in vital-neat-engine (npm)
- C
Malicious Package in reactive-cashflow (npm)
About Snyk
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.
