We’ve disclosed 3297 vulnerabilities
by Snyk Security
Researchers
How to fix?
Avoid using all malicious instances of the tukaani-project/xz
package.
cargo-hub-ui-api-internal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.
pretix is a Reinventing presales, one ticket at a time
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the control panel due to improper user input sanitization in the placeholders (like {name}
or {event}
). An attacker can inject HTML tags into email previews on the settings page by exploiting this vulnerability.
NOTE:
This is only exploitable if a Content Security Policy (CSP) bypass occurs.
org.webjars.bowergithub.guillaumepotier:gettext.js is a gettext.js is a lightweight (3kB minified!) but complete and accurate GNU gettext port for Node.js and the browser. Manage your i18n translations the right way in your JavaScript projects.
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the handling of .po
dictionary definition files. An attacker can inject malicious scripts by corrupting these files.
Cross-site Scripting (XSS) in prosemirror-model (npm)
Denial of Service (DoS) in github.com/nats-io/gnatsd/server (golang)
Heap-based Buffer Overflow in github.com/swift-server-community/APNSwift (swift)
Server-side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8/pkg/modules/webhook (golang)
Server-side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8/pkg/modules/chromium (golang)
by Snyk Security
Researchers
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.