All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.
A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery (CSRF), which if exploited could lead an attacker to gain unauthorized access to the web application and perform an unwanted operation on it without the knowledge of the legitimate user. An attacker, who successfully makes an MSM user who has already…
A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session cookies. Thus, an attacker who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per…
All versions of package git-archive are vulnerable to Command Injection via the exports function.
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
This affects all versions of package google-cloudstorage-commands.
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js
Стандартный логгер OpenFeign предоставляет весьма неудобный подход в логировании коммуникаций — он записывает запрос отдельно от ответа, причём каждый заголовок и тело - это отдельная строка логов.Очень неудобно разбирать такие логи в приложении с высоким уровнем коммуникаций, особенно в многопоточной среде.Решение ‘Normalized Logger’ нацелено исправить этот изъян - этот логгер собирает в одну запись будущего лога запрос и ответ - теперь они не будут разбросаны. Читать далее