apk package
chainguard/opensearch-dashboards-2-fips-dashboards-observability
pkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-observability
Vulnerabilities (66)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-28863 | Med | 6.5 | < 2.15.0-r0 | 2.15.0-r0 | Mar 21, 2024 | node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js cl | |
| CVE-2024-28849 | Med | 6.5 | < 2.13.0-r0 | 2.13.0-r0 | Mar 14, 2024 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which | |
| CVE-2023-26159 | Hig | 7.3 | < 2.13.0-r0 | 2.13.0-r0 | Jan 2, 2024 | Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this | |
| CVE-2023-45857 | Med | 6.5 | < 2.13.0-r0 | 2.13.0-r0 | Nov 8, 2023 | An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information. | |
| CVE-2023-28155 | Med | 6.1 | < 2.19.1-r0 | 2.19.1-r0 | Mar 16, 2023 | The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintaine | |
| CVE-2020-36604 | Hig | 8.1 | < 2.13.0-r0 | 2.13.0-r0 | Sep 23, 2022 | hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. |
- affected < 2.15.0-r0fixed 2.15.0-r0
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js cl
- affected < 2.13.0-r0fixed 2.13.0-r0
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which
- affected < 2.13.0-r0fixed 2.13.0-r0
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this
- affected < 2.13.0-r0fixed 2.13.0-r0
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
- affected < 2.19.1-r0fixed 2.19.1-r0
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintaine
- affected < 2.13.0-r0fixed 2.13.0-r0
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Page 4 of 4