We’ve disclosed3416vulnerabilities
by Snyk Security
Researchers
Upgrade postgresql
to version 13.19, 14.16, 15.11, 16.7, 17.3 or higher.
angular-sanitize is an AngularJS module for sanitizing HTML
Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements through the ngSanitize
module. An attacker can manipulate image sources and perform content spoofing by injecting malicious URLs into the 'href' and 'xlink:href' attributes of '' SVG elements.
Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status.
openmanus is an Add your description here
Affected versions of this package are vulnerable to Access Control Bypass through the execute
function. An attacker can manipulate file handling operations by exploiting the improper access controls configured in the system. This is only exploitable if the attacker has local access to the system.
org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to the improper handling of sasl.oauthbearer.token.endpoint.url
and sasl.oauthbearer.jwks.endpoint.url
configurations. An attacker can read arbitrary contents of the disk and environment variables or make requests to an unintended location by manipulating these configurations.
Note: This is only exploitable if configurations can be specified by an untrusted party.
by Snyk Security
Researchers
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.