Impact
Access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted.
Patches
v20.12.7 (LTS)
v21.12.2 (LTS)
v22.6.1
References
https://github.com/sanic-org/sanic/issues/2478
https://github.c…
Impact
Users electing to prevent others starting private discussions with themselves.
Please note that admins and others with appropriate permissions can always bypass this preference, as was the case before.
Patches
Users of Byobu should update the …
Impact
Untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server.
The root cause of the issue is during dataframe parsing.
Affected versions would allocate a buffer based on the declared dataframe size, whic…
A command injection vulnerability affects all versions of the package node-latex-pdf.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28433
https://security.snyk.io/vuln/SNYK-JS-NODELATEXPDF-1050426
https://github.com/advisories/GHSA-32fw-9wq8-9x…
A command injection vulnerability affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28434
https://security.snyk.io/vuln/SNYK-JS-GITBLAME-1050430…
A command injection vulnerability affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28437
https://security.snyk.io/vuln/SNYK-JS-…
The package get-npm-package-version before 1.0.7 is vulnerable to Command Injection via the main function in index.js.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-7795
https://github.com/hoperyy/get-npm-package-version/commit/40b1cf31a0607ea6…
A command injection vulnerability affects the package image-tiler before version 2.0.2.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28451
https://github.com/MrP/image-tiler/commit/f4a0b13a4bf43655fc4013e04bbceaf77aecbeb8
https://security.snyk…
A command injection vulnerability affects all versions of the package curljs.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-28425
https://security.snyk.io/vuln/SNYK-JS-CURLJS-1050404
https://github.com/advisories/GHSA-cqfc-9452-r36j
Impact
next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected.
If an attacker could forge a request that sent a comma-separated list of emails (eg.: attacker@attacker.com,victim@victim.com) to the sign-…
