We’ve disclosed3396vulnerabilities
by Snyk Security
Researchers
Snyk Vulnerability Database
The leading database for open source vulnerabilities and cloud misconfigurations.
Improper Neutralization of Quoting Syntax
Affecting postgresql package, versions [,13.19) , [14.0,14.16) , [15.0,15.11) , [16.0,16.7) , [17.0,17.3)
How to fix?
Upgrade postgresql to version 13.19, 14.16, 15.11, 16.7, 17.3 or higher.
Vulnerabilities from the last week
Server-side Request Forgery (SSRF)
Affects
ip-utils is a Library of useful functions related to IP
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to improper handling of non-standard IP address representations. The isPrivate() function fails to correctly identify certain private IP addresses when they are presented in hexadecimal or octal formats.
Deserialization of Untrusted Data
Affects
keras is a Keras is a high-level neural networks API for Python..
Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the load_model() function, which uses pickle for serialization. An attacker can execute code even if safe_mode is set to True, by supplying a malicious .keras file. The included config.json can be manipulated to point to and load npz model files containing executable code.
XML External Entity (XXE) Injection
Affected versions of this package are vulnerable to XML External Entity (XXE) Injection over the bucket creation endpoint. In createServiceFactory, external entities referenced in the CreateBucketConfiguration XML document are resolved and retrieved. This allows attackers to perform server-side request forgery (SSRF) attacks or expose information from internal URLs that are not meant to be accessible.
Recent vulnerabilities disclosed by Snyk
- H
Cross-site Scripting (XSS) in phpoffice/phpexcel (composer)- C
Embedded Malicious Code in cdn-icon-fetcher-help (npm)- C
Embedded Malicious Code in cdn-icon-fetch (npm)- M
Insertion of Sensitive Information into Log File in ray (pip)- M
Cross-site Scripting (XSS) in tarteaucitronjs (npm)
About Snyk
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.
