automation-platform-ui vulnerabilities (Red Hat)
85 vulnerabilities.
automation-platform-uiRed HatServer-side file-write and request forgery via spatial lookups8.7 Highautomation-platform-uiRed HatAIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)7.1 Highautomation-platform-uiRed HatGitPython before 3.1.57 Arbitrary File Overwrite and Read7.2 Highautomation-platform-uiRed Hatfflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives6.6 Mediumautomation-platform-uiRed HatGitPython before 3.1.52 Environment Variable Exfiltration via clone_from8.7 Highautomation-platform-uiRed HatGitPython before 3.1.51 Command Injection via unguarded Git options8.6 Highautomation-platform-uiRed HatGitPython before 3.1.51 Command Injection via option prefix abbreviation8.7 Highautomation-platform-uiRed HatGitPython 3.1.50 Authentication Bypass via Joined Short Options9.3 Criticalautomation-platform-uiRed Hatpyasn1: Uncontrolled resource consumption when converting decoded REAL values7.5 Highautomation-platform-uiRed HatSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion7.4 Highautomation-platform-uiRed Hatform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)8.7 Highautomation-platform-uiRed HatAwxkit: path traversal via yaml !include directive4.7 Mediumautomation-platform-uiRed HatAxios: Allocation of Resources Without Limits or Throttling in axios7.5 Highautomation-platform-uiRed HatUnbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service5.3 Mediumautomation-platform-uiRed HatAIOHTTP Vulnerable to Deserialization of Untrusted Data6.4 Mediumautomation-platform-uiRed HatAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge7.0 Highautomation-platform-uiRed HatPyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed7.4 Highautomation-platform-uiRed Hattmp: Path Traversal via unsanitized prefix/postfix enables directory escape7.7 Highautomation-platform-uiRed Hatprotobufjs: Code injection through bytes field defaults in generated toObject code7.7 Highautomation-platform-uiRed Haturllib3: Decompression-bomb safeguards bypassed in parts of the streaming API8.9 Highautomation-platform-uiRed Haturllib3: Sensitive headers forwarded across origins in proxied low-level redirects8.2 Highautomation-platform-uiRed HatAap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing8.2 Highautomation-platform-uiRed HatAap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking8.3 Highautomation-platform-uiRed Hat[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"7.2 Highautomation-platform-uiRed HatAxios: Header Injection via Prototype Pollution7.4 Highautomation-platform-uiRed HatPillow is vulnerable to a FITS GZIP decompression bomb8.7 Highautomation-platform-uiRed HatAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain4.8 Mediumautomation-platform-uiRed Hatcryptography has a buffer overflow if non-contiguous buffers were passed to APIs6.9 Mediumautomation-platform-uiRed HatUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls7.5 Highautomation-platform-uiRed HatTOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix6.4 Mediumautomation-platform-uiRed HatUnexpected work during chain building in crypto/x5097.5 Highautomation-platform-uiRed HatJWCrypto: JWE ZIP decompression bomb5.3 Mediumautomation-platform-uiRed HatVite Affected by Arbitrary File Read via Vite Dev Server WebSocket8.2 Highautomation-platform-uiRed Hatlodash vulnerable to Code Injection via `_.template` imports key names8.1 Highautomation-platform-uiRed HatForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input7.5 Highautomation-platform-uiRed Hatpath-to-regexp vulnerable to Denial of Service via sequential optional groups7.5 Highautomation-platform-uiRed Hatdynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver7.5 Highautomation-platform-uiRed Hatpyasn1 Vulnerable to Denial of Service via Unbounded Recursion7.5 Highautomation-platform-uiRed HatpyOpenSSL DTLS cookie callback buffer overflow7.2 Highautomation-platform-uiRed HatPyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 Highautomation-platform-uiRed HatIncorrect parsing of IPv6 host literals in net/url7.5 Highautomation-platform-uiRed HatPython-Markdown has an Uncaught Exception7.5 Highautomation-platform-uiRed HatSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)7.5 Highautomation-platform-uiRed Hatminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions7.5 Highautomation-platform-uiRed HatRollup 4 has Arbitrary File Write via Path Traversal8.8 Highautomation-platform-uiRed Hatminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern8.7 Highautomation-platform-uiRed HatPillow has an out-of-bounds write when loading PSD images8.6 Highautomation-platform-uiRed Hatajv has ReDoS when using `$data` option2.9 Lowautomation-platform-uiRed HatAxios affected by Denial of Service via __proto__ Key in mergeConfig7.5 Highautomation-platform-uiRed HatPotential SQL injection via QuerySet.order_by and FilteredRelation5.4 Medium- Show moreLoading…