Schwachstellen, die jetzt zählen.

node-server: node-server: Security middleware bypass via double path decoding in serveStatic

vite: Vite: Information disclosure via filesystem access control bypass

happy-dom: happy-dom: Cookie injection via improper cookie domain validation

happy-dom: happy-dom: Server-Side Request Forgery via default loading of external resources

server-renderer: Happy DOM: Information disclosure via Server-Side Request Forgery

github.com/labstack/echo: Echo: Arbitrary URI redirect via unvalidated forwarded scheme headers

github.com/labstack/echo: echo: Security control bypass via untrusted forwarded scheme headers

github.com/labstack/echo: Echo: Open redirect via improper URI sanitization

github.com/labstack/echo: Echo: Information disclosure via double URL decoding in static middleware

github.com/labstack/echo: Echo: Information disclosure via path normalization in static file handlers

Red Hat Enterprise Linux (python-jwcrypto, sos, hickory-resolver, libimobiledevice, gcc, python-oauthlib): Mehrere Schwachstellen

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector ) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.

nfs-ganesha: nfs-ganesha: NFSv4.1 cached-READ session-slot replay causes double-free and use-after-free read

github.com/labstack/echo: Echo: Rate limiting bypass via spoofed IP headers

github.com/labstack/echo: Echo: Reflected Cross-Site Scripting via unvalidated JSONP callback

github.com/labstack/echo: Echo: IP address spoofing via forwarded X-Real-IP header

github.com/labstack/echo: Echo: Information disclosure via URL path interpretation discrepancy

github.com/labstack/echo: Echo: CSRF protection bypass via MethodOverride safe method rewriting

Red Hat Enterprise Linux (python-jwcrypto, sos, hickory-resolver, libimobiledevice, gcc, python-oauthlib): Mehrere Schwachstellen

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).

github.com/labstack/echo: Echo: IP address spoofing via improper X-Real-IP header validation

github.com/labstack/echo: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

github.com/labstack/echo: Echo: Request body limit bypass via BodyDump error handling

github.com/labstack/echo: echo: Denial of Service (DoS) via unclosed WebSocket proxy connections

github.com/coder/coder: coder: unauthorized session access via missing JWT audience validation

github.com/go-chi/chi: chi: Authentication bypass via SuppressNotFound middleware

github.com/labstack/echo: Echo: Denial of Service via unbounded request decompression

github.com/labstack/echo: echo: Denial of Service via memory exhaustion in BodyDump middleware

i18next-http-backend: i18next-http-backend: Information disclosure via query parameter injection

vue-i18n: core-base: vue-i18n: Cross-Site Scripting via improper iframe srcdoc sanitization

vue-i18n: vue-i18n: HTML injection via unescaped named interpolation parameters

grid: Highcharts Grid: Cross-site scripting via unvalidated URL scheme in credit links