Archive — The Standup

12 results

HIGH: undici — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly…

3h ago · undici · Bluesky

ADVISORY

HIGH: fast-uri — fast-uri vulnerable to host confusion via backslash authority introducer

Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything…

10h ago · fast-uri · Threads

ADVISORY

CRITICAL: @nocobase/plugin-notification-in-app-message — NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal() template string with no escape, type cast, or parameter…

3d ago · @nocobase/plugin-notification-in-app-message · Threads

ADVISORY

CRITICAL: @aws-amplify/codegen-ui-react — AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface (AWS…

4d ago · @aws-amplify/codegen-ui-react · Bluesky

ADVISORY

HIGH: dssrf — dssrf has an SSRF bypass with remove_at_symbol_in_string

Summary isurlsafe in v1.0.3 contains an SSRF bypass. removeatsymbolinstring is applied to the raw URL string before new URL() parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked.…

4d ago · dssrf · Bluesky

ADVISORY

HIGH: github.com/tinfoil-factory/netfoil — netfoil: Incorrect block responses could lead to localhost traffic

Summary 0.0.0.0 was used instead of NXDOMAIN for block responses. On Linux, which is the target platform for netfoil, the 0.0.0.0 is sent to localhost rather than just dropped. Impact Unintended traffic could be sent to localhost. Impact depends on running…

5d ago · github.com/tinfoil-factory/netfoil · Bluesky

ADVISORY

CRITICAL: github.com/kube-logging/logging-operator — Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values…

5d ago · github.com/kube-logging/logging-operator · Threads

ADVISORY

HIGH: org.verapdf:validation-model — veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection (CWE-611) vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious…

6d ago · org.verapdf:validation-model · Threads

ADVISORY

HIGH: style-dictionary — Style Dictionary - Prototype Pollution in convertTokenData utility function

Impact Prototype pollution. A malicious user can create a token array [{ key: '{proto.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key:…

6d ago · style-dictionary · Bluesky

ADVISORY

HIGH: github.com/fission/fission — Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at…

6d ago · github.com/fission/fission · Bluesky

ADVISORY

HIGH: System.Security.Cryptography.Xml — Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this…

6d ago · System.Security.Cryptography.Xml · Threads

ADVISORY

HIGH: SIPSorcery — SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet (and STUN attribute) bytes without sufficient length checks and throws, and the UDP…

6d ago · SIPSorcery · Bluesky