hugo vulnerabilities (Red Hat)
33 vulnerabilities.
-
hugoRed Hat kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter 7.5 High -
hugoRed Hat kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash 7.5 High -
hugoRed Hat kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path 7.5 High -
hugoRed Hat Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs 5.1 Medium -
hugoRed Hat Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor 6.7 Medium -
hugoRed Hat Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver 6.7 Medium -
hugoRed Hat Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback 6.7 Medium -
hugoRed Hat kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion 7.4 High -
hugoRed Hat kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression 5.3 Medium -
hugoRed Hat kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content 8.2 High -
hugoRed Hat kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) 5.3 Medium -
hugoRed Hat kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path 5.3 Medium -
hugoRed Hat kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items 7.5 High -
hugoRed Hat Hugo before 0.166.0 Cross-Site Scripting via text/org 5.1 Medium -
hugoRed Hat Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass 8.6 High -
hugoRed Hat Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots 8.7 High -
hugoRed Hat Hugo before 0.166.0 Stored XSS via lineAnchors code block option 5.1 Medium -
hugoRed Hat Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks 8.7 High -
hugoRed Hat Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values 4.8 Medium -
hugoRed Hat Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation 8.3 High -
hugoRed Hat kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default 9.1 Critical -
hugoRed Hat Infinite loop on invalid input in golang.org/x/text 7.5 High -
hugoRed Hat Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings 4.6 Medium -
hugoRed Hat Hugo symlink confinement bypass in os.ReadFile 5.9 Medium -
hugoRed Hat Hugo default code block renderer XSS via unescaped code-fence language 5.1 Medium -
hugoRed Hat Hugo: Symlink confinement bypass in resources.Get 6.9 Medium -
hugoRed Hat Hugo: security.http.urls allow-list bypass via HTTP redirects 6.3 Medium -
hugoRed Hat Hugo: XSS via text/html content files 5.1 Medium -
hugoRed Hat OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse 2.1 Low -
hugoRed Hat Hugo: Node tool execution allows file system access outside the project directory 6.2 Medium -
hugoRed Hat Excessive memory allocation when decoding malicious SFNT in golang.org/x/image 6.1 Medium -
hugoRed Hat Hugo does not properly escape some Markdown links 5.3 Medium -
hugoRed Hat Infinite loop in JSON unmarshaling in google.golang.org/protobuf 7.5 High