agama-web-ui vulnerabilities (openSUSE)
43 vulnerabilities.
agama-web-uiopenSUSEfollow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects5.9 Mediumagama-web-uiopenSUSESerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body2.1 Lowagama-web-uiopenSUSEserialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body2.3 Lowagama-web-uiopenSUSEbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request body7.5 Highagama-web-uiopenSUSEfollow-redirects array-form headers bypass cross-origin credential stripping8.2 Highagama-web-uiopenSUSEfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references3.7 Lowagama-web-uiopenSUSEfollow-redirects sensitiveHeaders regex escaping can expose credential headers8.2 Highagama-web-uiopenSUSEbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service5.3 Mediumagama-web-uiopenSUSEfast-uri vulnerable to inconsistent host case normalization via percent-encoded octets4.8 Mediumagama-web-uiopenSUSESVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements6.1 Mediumagama-web-uiopenSUSEBrowserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM7.5 Highagama-web-uiopenSUSEBrowserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)7.5 Highagama-web-uiopenSUSEfast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding7.5 Highagama-web-uiopenSUSEaxios before 0.33.0 Prototype Pollution via nested option objects6.3 Mediumagama-web-uiopenSUSEnanoid: Integer Overflow or Wraparound7.4 Highagama-web-uiopenSUSEPostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset6.3 Mediumagama-web-uiopenSUSESVGO: removeScripts plugin leaves some executable scripts intact8.2 Highagama-web-uiopenSUSEaxios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass6.9 Mediumagama-web-uiopenSUSEaxios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream6.3 Mediumagama-web-uiopenSUSEaxios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.06.9 Mediumagama-web-uiopenSUSEaxios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON6.3 Mediumagama-web-uiopenSUSEwebsocket-driver: Resource limit bypass via message compression6.3 Mediumagama-web-uiopenSUSEwebsocket-driver: Message corruption via abuse of protocol length headers9.2 Criticalagama-web-uiopenSUSEbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups7.7 Highagama-web-uiopenSUSEfast-uri vulnerable to host confusion via failed IDN canonicalization7.5 Highagama-web-uiopenSUSEshell-quote parse() is quadratic in token count, enabling denial of service8.7 Highagama-web-uiopenSUSEReact Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass3.1 Lowagama-web-uiopenSUSENTLMv2 hash disclosure via UNC path handling on Windows5.5 Mediumagama-web-uiopenSUSEjs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases5.3 Mediumagama-web-uiopenSUSEBabel: Arbitrary File Read via sourceMappingURL Comment in @babel/core3.2 Lowagama-web-uiopenSUSEform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)8.7 Highagama-web-uiopenSUSEReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation6.6 Mediumagama-web-uiopenSUSEReact Router vulnerable to Denial of Service via reflected user input in single-fetch7.5 Highagama-web-uiopenSUSEReact Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets8.0 Highagama-web-uiopenSUSEshell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`9.2 Criticalagama-web-uiopenSUSEwebpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins5.3 Mediumagama-web-uiopenSUSEAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking7.4 Highagama-web-uiopenSUSEAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy4.8 Mediumagama-web-uiopenSUSEUnderscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack8.2 Highagama-web-uiopenSUSEUsage of unsafe random function in form-data for choosing boundary9.4 Criticalagama-web-uiopenSUSEon-headers vulnerable to http response header manipulation3.4 Lowagama-web-uiopenSUSECross-realm object access in Webpack 59.8 Criticalagama-web-uiopenSUSEhttp-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass6.9 Medium