Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-38545
https://github.com/xCss/Valine/issues/…
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-37258
https://github.com/stealjs/steal/issues/1527…
Impact
Read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the called function will make changes upon the contract’s B state, the state will be altered for contract B…
Impact
If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB.
Schemas that do not use @flexSearch…
Impact
It’s possible to store Javascript or groovy scripts in an mention macro anchor or reference field. The stored code is executed by anyone visiting the page with the mention.
For example, the example below will create a file at /tmp/exploit.txt:
{…
Impact
It’s possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the request (URL parameter) using the XWikiServerClassSheet if the user has view access to this sheet and another page that has been saved with…
Impact
The tags document Main.Tags in XWiki didn’t sanitize user inputs properly, allowing users with view rights on the document (default in a public wiki or for authenticated users on private wikis) to execute arbitrary Groovy, Python and Velocity co…
Two of the maintainers have indicated that the crate may not be maintained.
The crate has open issues including memory leaks and may not be suitable for production use.
It may be best to switch to the default Rust standard allocator on wasm32 targets.
…
The maintainer seems unreachable. The crate may or may not be usable as-is despite no maintenance and may not work in future versions of Rust. The last release seems to have been seven years ago.
References
https://github.com/reem/rust-typemap/issues/…
Crate traitobject has not had a release for over five years.
In addition there is an existing security advisory that has not been addressed:
RUSTSEC-2020-0027
Possible Alternative(s)
The below list has not been vetted in any way and may or may not c…
