velociraptor vulnerabilities (openSUSE)
125 vulnerabilities.
velociraptoropenSUSEMemory Exhaustion in braces7.5 HighvelociraptoropenSUSERegular Expression Denial of Service in micromatch5.3 MediumvelociraptoropenSUSEVite's `server.fs.deny` did not deny requests for patterns with directories5.9 MediumvelociraptoropenSUSEHTTP/2 CONTINUATION flood in net/http7.5 HighvelociraptoropenSUSEProxy-Authorization header kept across hosts in follow-redirects6.5 MediumvelociraptoropenSUSEGo JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)4.3 MediumvelociraptoropenSUSEInfinite loop in JSON unmarshaling in google.golang.org/protobuf7.5 HighvelociraptoropenSUSEVite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem7.5 HighvelociraptoropenSUSERapid7 Velociraptor Reflected XSS8.6 HighvelociraptoropenSUSEbrowserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack6.5 MediumvelociraptoropenSUSECross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml7.1 HighvelociraptoropenSUSEBabel vulnerable to arbitrary code execution when compiling specifically crafted malicious code9.4 CriticalvelociraptoropenSUSEPostCSS line return parsing error5.3 MediumvelociraptoropenSUSEsemver vulnerable to Regular Expression Denial of Service5.3 MediumvelociraptoropenSUSEImproper random reading in CIRCL5.3 MediumvelociraptoropenSUSERapid7 Velociraptor directory traversal in client ID parameter4.3 MediumvelociraptoropenSUSEInsufficient permission check in the VQL copy() function8.8 HighvelociraptoropenSUSEDOMPurify before 3.3.2 Mutation XSS via Re-Contextualization5.3 MediumvelociraptoropenSUSEDOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES5.1 MediumvelociraptoropenSUSEDOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR5.1 MediumvelociraptoropenSUSEDOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS5.1 MediumvelociraptoropenSUSEhttp-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass6.9 MediumvelociraptoropenSUSEDOMPurify nesting-based mXSS10.0 CriticalvelociraptoropenSUSEjs-yaml has prototype pollution in merge (<<)5.3 MediumvelociraptoropenSUSEInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna9.6 Critical